日志分析(python)
微秒 毫秒
datetime
seek定位指针
从行尾到行首
fd.seek(-2,1) 1 当前位置
fd.tell()
fd.seek(-2,2) 2 最后位置
fd.tell()
fd.seek(0,0) 0 最前位置
read（1）读一位 read（） 全部都读
tac与cat 行首到行尾
reversed 翻转字符串
只读一部分 通过时间判断
200 404 503 十分钟之内 第八列 apache.log
1.首先匹配时间格式，
DELTA = datetime.timedelta(minutes=3)
starttime = datetime.datetime.now() - DELTA
解决十分钟问题
2.从后往前读
3.第八列
line = [''] 列表里面是空值
os.SEEK_END
re.findall(r'[^\n]*\n?',s)
re.findall 返回是列表
python 日志搜集插件
diamond 搜集日志工具
搜集网络，搜集CPU，搜集内存
#!/usr/bin/env python
import time,datetime
import re
REG_SYSLOG =re.compile(r'(?P<logtime>\w+ \d+ [\d:]+) (?P<hostname>[\d\w.]+) (?P<programe>\w+)(\[\d*\])?:(?P<msg>.*)')
"""
GMT_FORMAT = '%b %d %H:%M:%S GMT'
datetime.datetime.utcnow().strftime(GMT_FORMAT)
now = datetime.datetime.now()
delta = datetime.timedelta(minutes=3)
threeago = now - delta
log = open('/var/log/messages').read()
nagioslog = log.startswith()
print nagioslog
"""
DELTA = datetime.timedelta(minute=3)
PROG_COUNTER = {}
KEYWORD = ['error','fatal']
def parsertime(s):
month,day,t = s.split()
hour,minute,second = [int(i) for i in t.split(':')]
return datetime.datetime(2014,MONTH_MAPPING[month])
def count(metric):
if metric in PROG_COUNTER:
PROG_COUNTER[metric] += 1
else:
PROG_COUNTER[metric] = 1
def getMessages():
starttime = datetime.datetime.now - DELTA
logfile ='/var/log/messages'
with open(logfile) as fd:
for line in fd:
logmatch = REG_SYSLOG.match(line)
if logmatch:
logdict = logmatch.groupdict()
logtime = parsetime(logdict['logtime'])
if logtime >= starttime:
count(logdict['progname'])
for k in KEYWORD:
if k in logdict['msg'].lower():
count(k,KEYWORD_COUNTER)
def check_counter():
if PROG_COUNTER:
for c in PROG_COUNTER:
if PROG_COUNTER[c] > 2:
print "Crital: prog %s has reached %s " % (c,PROG_COUNTER[c])
status = 2
elif PROG_COUNTER[c] <= 2:
print "Warning:prog %s has reached %s " (c,PROG_COUNTER[c])
status = 1
if KEYWORD_COUNTER:
status = 2
print "Crital:keywords have reached
if __name__ == '__main__':
getMessages()
"""
month,day,t = 'Apr 19 06:28:39'.split()
hour,minute,second = t.split(':')
datetime.datetime(2014,{'Apr':4}[month],int(day),int(hour),int(minute),int(second))
hour,minute,second = [int(i) for i in t.split(':')]
"""
本文出自 “muzinan的技术博客” 博客，谢绝转载！