Linux學(xué)習(xí)26-linux查看某個(gè)時(shí)間段的日志(sed -n)-史上最詳細(xì)

前言

在linux上查找日志的時(shí)候，如果我想找出某個(gè)時(shí)間段的日志，比如查找今天早上8點(diǎn)到下午2點(diǎn)的日志。

用grep不太方便直接過濾出來，可以使用sed根據(jù)時(shí)間去查找

sed -n '/開始時(shí)間日期/,/結(jié)束時(shí)間日期/p' all.log

查找日志

比如下面這段日志,前面的時(shí)間格式都是類似?2019-10-21 07:44:20

2019-10-2421:33:31,678[django.request:93][base:get_response][WARNING]- Not Found: /http:/123.125.114.144/2019-10-2421:33:31,679[django.server:124][basehttp:log_message][WARNING]-"HEADhttp://123.125.114.144/ HTTP/1.1"40416782019-10-2422:14:04,121[django.server:124][basehttp:log_message][INFO]- code400, message Bad request version ('HTTP')2019-10-2422:14:04,122[django.server:124][basehttp:log_message][WARNING]-"GET../../mnt/custom/ProductDefinition HTTP"400-2019-10-2422:16:21,052[django.server:124][basehttp:log_message][INFO]-"GET/api/login HTTP/1.1"30102019-10-2422:16:21,123[django.server:124][basehttp:log_message][INFO]-"GET/api/login/ HTTP/1.1"20038762019-10-2422:16:21,192[django.server:124][basehttp:log_message][INFO]-"GET/static/assets/img/main_bg.png HTTP/1.1"20028012019-10-2422:16:21,196[django.server:124][basehttp:log_message][INFO]-"GET/static/assets/iconfont/style.css HTTP/1.1"20016382019-10-2422:16:21,229[django.server:124][basehttp:log_message][INFO]-"GET/static/assets/img/bg.jpg HTTP/1.1"2001359902019-10-2422:16:21,307[django.server:124][basehttp:log_message][INFO]-"GET/static/assets/iconfont/fonts/icomoon.ttf?u4m6fy HTTP/1.1"20069002019-10-2422:16:23,525[django.server:124][basehttp:log_message][INFO]-"POST/api/login/ HTTP/1.1"30202019-10-2422:16:23,618[django.server:124][basehttp:log_message][INFO]-"GET/api/index/ HTTP/1.1"200184472019-10-2422:16:23,709[django.server:124][basehttp:log_message][INFO]-"GET/static/assets/js/commons.js HTTP/1.1"200132092019-10-2422:16:23,712[django.server:124][basehttp:log_message][INFO]-"GET/static/assets/css/admin.css HTTP/1.1"200196602019-10-2422:16:23,712[django.server:124][basehttp:log_message][INFO]-"GET/static/assets/css/common.css HTTP/1.1"20010042019-10-2422:16:23,714[django.server:124][basehttp:log_message][INFO]-"GET/static/assets/js/app.js HTTP/1.1"200208442019-10-2422:16:26,509[django.server:124][basehttp:log_message][INFO]-"GET/api/report_list/1/ HTTP/1.1"200146492019-10-2422:16:51,496[django.server:124][basehttp:log_message][INFO]-"GET/api/test_list/1/ HTTP/1.1"200248742019-10-2422:16:51,721[django.server:124][basehttp:log_message][INFO]-"POST/api/add_case/ HTTP/1.1"20002019-10-2422:16:59,707[django.server:124][basehttp:log_message][INFO]-"GET/api/test_list/1/ HTTP/1.1"200248742019-10-2422:16:59,909[django.server:124][basehttp:log_message][INFO]-"POST/api/add_case/ HTTP/1.1"20002019-10-2422:17:01,306[django.server:124][basehttp:log_message][INFO]-"GET/api/edit_case/1/ HTTP/1.1"200365042019-10-2422:17:06,265[django.server:124][basehttp:log_message][INFO]-"GET/api/add_project/ HTTP/1.1"200177372019-10-2422:17:07,825[django.server:124][basehttp:log_message][INFO]-"GET/api/project_list/1/ HTTP/1.1"200297892019-10-2422:17:13,116[django.server:124][basehttp:log_message][INFO]-"GET/api/add_config/ HTTP/1.1"200248162019-10-2422:17:19,671[django.server:124][basehttp:log_message][INFO]-"GET/api/config_list/1/ HTTP/1.1"20019532

比如我要查找上面的從?2019-10-24 22:16:21?到?2019-10-24 22:16:59?這個(gè)時(shí)間段的日志

sed -n '/2019-10-24 22:16:21/,/2019-10-24 22:16:59/p' all.log

[root@VM_0_2_centos logs]# sed -n? '/2019-10-2422:16:21/,/2019-10-2422:16:59/p' all.log2019-10-2422:16:21,052[django.server:124][basehttp:log_message][INFO]-"GET/api/login HTTP/1.1"30102019-10-2422:16:21,123[django.server:124][basehttp:log_message][INFO]-"GET/api/login/ HTTP/1.1"20038762019-10-2422:16:21,192[django.server:124][basehttp:log_message][INFO]-"GET/static/assets/img/main_bg.png HTTP/1.1"20028012019-10-2422:16:21,196[django.server:124][basehttp:log_message][INFO]-"GET/static/assets/iconfont/style.css HTTP/1.1"20016382019-10-2422:16:21,229[django.server:124][basehttp:log_message][INFO]-"GET/static/assets/img/bg.jpg HTTP/1.1"2001359902019-10-2422:16:21,307[django.server:124][basehttp:log_message][INFO]-"GET/static/assets/iconfont/fonts/icomoon.ttf?u4m6fy HTTP/1.1"20069002019-10-2422:16:23,525[django.server:124][basehttp:log_message][INFO]-"POST/api/login/ HTTP/1.1"30202019-10-2422:16:23,618[django.server:124][basehttp:log_message][INFO]-"GET/api/index/ HTTP/1.1"200184472019-10-2422:16:23,709[django.server:124][basehttp:log_message][INFO]-"GET/static/assets/js/commons.js HTTP/1.1"200132092019-10-2422:16:23,712[django.server:124][basehttp:log_message][INFO]-"GET/static/assets/css/admin.css HTTP/1.1"200196602019-10-2422:16:23,712[django.server:124][basehttp:log_message][INFO]-"GET/static/assets/css/common.css HTTP/1.1"20010042019-10-2422:16:23,714[django.server:124][basehttp:log_message][INFO]-"GET/static/assets/js/app.js HTTP/1.1"200208442019-10-2422:16:26,509[django.server:124][basehttp:log_message][INFO]-"GET/api/report_list/1/ HTTP/1.1"200146492019-10-2422:16:51,496[django.server:124][basehttp:log_message][INFO]-"GET/api/test_list/1/ HTTP/1.1"200248742019-10-2422:16:51,721[django.server:124][basehttp:log_message][INFO]-"POST/api/add_case/ HTTP/1.1"20002019-10-2422:16:59,707[django.server:124][basehttp:log_message][INFO]-"GET/api/test_list/1/ HTTP/1.1"20024874[root@VM_0_2_centos logs]#

看起來使用很簡(jiǎn)單，但是會(huì)有很大坑，比如時(shí)間后面的/p不能漏掉了

遇到的坑

開始時(shí)間和結(jié)束時(shí)間必須要是日志里面有的，要是沒有的時(shí)間，那查找就沒有結(jié)果，這個(gè)我也被坑過，看網(wǎng)上的教程都是這句，但評(píng)論里面總有人說沒成功。

后來經(jīng)過實(shí)踐，指令是沒有問題的，只是開始時(shí)間和結(jié)束時(shí)間必須要是日志里面有才行。

如果開始時(shí)間日志里面是沒有的，那么查詢結(jié)果為空，比如開始時(shí)間沒有2019-10-24 22:16:22

sed -n '/2019-10-24 22:16:22/,/2019-10-24 22:16:59/p' all.log

如果結(jié)束時(shí)間日志里面是沒有的，查詢的結(jié)果就是開始時(shí)間到最后的全部日志

sed -n '/2019-10-24 22:16:21/,/2019-10-24 22:16:58/p' all.log

模糊查詢

如果不知道日志的開始時(shí)間，不能精確到秒，可以用模糊查詢,比如查詢時(shí)間段2019-10-24 22:14 到 2019-10-24 22:16

sed -n '/2019-10-24 22:14:*/,/2019-10-24 22:16:*/p' all.log

[root@VM_0_2_centos logs]# sed -n? '/2019-10-2422:14:*/,/2019-10-2422:16:*/p' all.log2019-10-2422:14:04,121[django.server:124][basehttp:log_message][INFO]- code400, message Bad request version ('HTTP')2019-10-2422:14:04,122[django.server:124][basehttp:log_message][WARNING]-"GET../../mnt/custom/ProductDefinition HTTP"400-2019-10-2422:16:21,052[django.server:124][basehttp:log_message][INFO]-"GET/api/login HTTP/1.1"3010[root@VM_0_2_centos logs]#

也可以按小時(shí)模糊查詢

sed -n '/2019-10-24 21*/,/2019-10-24 22*/p' all.log

結(jié)合grep查詢

sed 也可以結(jié)合 grep 使用，比如我查詢上面日志某個(gè)時(shí)間段的帶有?POST?的日志行

sed -n '/2019-10-24 22:16:21/,/2019-10-21 20:16:58/p' all.log | grep POST

[root@VM_0_2_centos logs]# sed -n? '/2019-10-2422:16:21/,/2019-10-2120:16:58/p' all.log | grep post[root@VM_0_2_centos logs]# sed -n? '/2019-10-2422:16:21/,/2019-10-2120:16:58/p' all.log | grep POST2019-10-2422:16:23,525[django.server:124][basehttp:log_message][INFO]-"POST/api/login/ HTTP/1.1"30202019-10-2422:16:51,721[django.server:124][basehttp:log_message][INFO]-"POST/api/add_case/ HTTP/1.1"20002019-10-2422:16:59,909[django.server:124][basehttp:log_message][INFO]-"POST/api/add_case/ HTTP/1.1"20002019-10-2422:17:19,864[django.server:124][basehttp:log_message][INFO]-"POST/api/add_case/ HTTP/1.1"2000[root@VM_0_2_centos logs]#

日志導(dǎo)出

我們可以查詢某個(gè)時(shí)間段的日志，導(dǎo)出到本地

sed -n '/2019-10-24 22:16:21/,/2019-10-21 20:16:58/p' all.log > yoyo.log

[root@VM_0_2_centos logs]# sed -n'/2019-10-24 22:16:21/,/2019-10-21 20:16:58/p'all.log> yoyo.log[root@VM_0_2_centos logs]# lltotal1740-rw-r--r-- 1 root root? ? 1907 Oct 24 22:54 11.txt-rw-r--r-- 1 root root 1081515 Oct 24 23:04 all.log-rw-r--r-- 1 root root? 686962 Oct 24 23:04 script.log-rw-r--r-- 1 root root? ? 3053 Oct 24 23:08 yoyo.log[root@VM_0_2_centos logs]#

?著作權(quán)歸作者所有,轉(zhuǎn)載或內(nèi)容合作請(qǐng)聯(lián)系作者
【社區(qū)內(nèi)容提示】社區(qū)部分內(nèi)容疑似由AI輔助生成，瀏覽時(shí)請(qǐng)結(jié)合常識(shí)與多方信息審慎甄別。
平臺(tái)聲明：文章內(nèi)容（如有圖片或視頻亦包括在內(nèi)）由作者上傳并發(fā)布，文章內(nèi)容僅代表作者本人觀點(diǎn)，簡(jiǎn)書系信息發(fā)布平臺(tái)，僅提供信息存儲(chǔ)服務(wù)。

友情鏈接更多精彩內(nèi)容