awk 分析nginx日志

ljwd1000

需求，統(tǒng)計出每個小時出現的訪問狀態(tài)（nginx狀態(tài)碼：例如，200,302,502,504等）次數，要求輸出結果格式為：

時間    狀態(tài)   次數



日志文件格式類似如下，但是nginx的log并沒有我貼出的這么整齊

1. 10.150.82.151 - - [22/Nov/2012:03:02:45 +0900] "POST /m/gashapon/free/1/?signed=1&t=1353524557.0 HTTP/1.1" 302 0 "-" "DoCoMo/2.0 SH06A3(c500;TB;W24H14)" "116.93.151.35" 0.095
   
2. 10.150.82.152 - - [22/Nov/2012:03:02:45 +0900] "POST /m/gashapon/free/1/?signed=1&t=1353524557.0 HTTP/1.1" 302 0 "-" "DoCoMo/2.0 SH06A3(c500;TB;W24H14)" "116.93.151.35" 0.095
   
3. 10.150.82.122 - - [22/Nov/2012:04:02:45 +0900] "POST /m/gashapon/free/1/?signed=1&t=1353524557.0 HTTP/1.1" 200 0 "-" "DoCoMo/2.0 SH06A3(c500;TB;W24H14)" "116.93.151.35" 0.095
   
4. 10.150.82.157 - - [22/Nov/2012:04:02:45 +0900] "POST /m/gashapon/free/1/?signed=1&t=1353524557.0 HTTP/1.1" 502 0 "-" "DoCoMo/2.0 SH06A3(c500;TB;W24H14)" "116.93.151.35" 0.095
   
5. 10.150.82.153 - - [22/Nov/2012:06:02:45 +0900] "POST /m/gashapon/free/1/?signed=1&t=1353524557.0 HTTP/1.1" 504 0 "-" "DoCoMo/2.0 SH06A3(c500;TB;W24H14)" "116.93.151.35" 0.095
   
6. 10.150.82.156 - - [22/Nov/2012:06:02:45 +0900] "POST /m/gashapon/free/1/?signed=1&t=1353524557.0 HTTP/1.1" 502 0 "-" "DoCoMo/2.0 SH06A3(c500;TB;W24H14)" "116.93.151.35" 0.095

復制代碼

我寫個大概的，不知道如何去精確取得狀態(tài)碼這一列

1. awk  '{split($4,a,":|\\[");time=a[2]":"a[3];for(i=1;i<=NF;i++){if($i==502||$i==504){num[time"\t"$i]++}}}END{for(i in num)print i,num[i]}'

復制代碼

yestreenstars

總要給點數據來測試吧？

kernel69

再添點東西吧

1. 我是是測試

復制代碼

ljwd1000

1. 10.150.82.151 - - [22/Nov/2012:03:02:45 +0900] "POST /m/gashapon/free/1/?signed=1&t=1353524557.0 HTTP/1.1" 302 0 "-" "DoCoMo/2.0 SH06A3(c500;TB;W24H14)" "116.93.151.35" 0.095
   
2. 10.150.82.152 - - [22/Nov/2012:03:02:45 +0900] "POST /m/gashapon/free/1/?signed=1&t=1353524557.0 HTTP/1.1" 302 0 "-" "DoCoMo/2.0 SH06A3(c500;TB;W24H14)" "116.93.151.35" 0.095
   
3. 10.150.82.122 - - [22/Nov/2012:04:02:45 +0900] "POST /m/gashapon/free/1/?signed=1&t=1353524557.0 HTTP/1.1" 200 0 "-" "DoCoMo/2.0 SH06A3(c500;TB;W24H14)" "116.93.151.35" 0.095
   
4. 10.150.82.157 - - [22/Nov/2012:04:02:45 +0900] "POST /m/gashapon/free/1/?signed=1&t=1353524557.0 HTTP/1.1" 502 0 "-" "DoCoMo/2.0 SH06A3(c500;TB;W24H14)" "116.93.151.35" 0.095
   
5. 10.150.82.153 - - [22/Nov/2012:06:02:45 +0900] "POST /m/gashapon/free/1/?signed=1&t=1353524557.0 HTTP/1.1" 504 0 "-" "DoCoMo/2.0 SH06A3(c500;TB;W24H14)" "116.93.151.35" 0.095
   
6. 10.150.82.156 - - [22/Nov/2012:06:02:45 +0900] "POST /m/gashapon/free/1/?signed=1&t=1353524557.0 HTTP/1.1" 502 0 "-" "DoCoMo/2.0 SH06A3(c500;TB;W24H14)" "116.93.151.35" 0.095

復制代碼

回復 2# yestreenstars


    類似于這樣的log，但是數據沒有這么整齊，呵呵

ljwd1000

回復 4# ljwd1000


    已經修改了。幫忙看看，謝謝了

ljwd1000

回復 6# zooyo

1. 22/Nov/2012:06  504 934

復制代碼

類似于此

yestreenstars

1. awk '{a=substr($4,2,14);b[a" "$9]++}END{for(i in b)print i,b[i]}' file | sort

復制代碼

or

1. awk '{a=gensub(/\[(.*):.*:.*/,"\\1",1,$4);b[a" "$9]++}END{for(i in b)print i,b[i]}' file | sort

復制代碼

ljwd1000

回復 8# yestreenstars


    哎，給的數據太整齊了。真不好意思。狀態(tài)碼那一列以空格分割不是固定的位置。。。

yestreenstars

回復 9# ljwd1000


    把你所有的特例也要寫出來啊，不然怎么搞啊