最近1分钟的PHP日志

Question

我需要PHP-fpm的最后1分钟日志来自动生成警报并在其他应用程序上使用webhook。我使用了下面提到的命令

awk -v d1="$(date --date '-60 min' '+%d/%b/%Y:%T')" '{gsub(/^[[t]+/, "", $1);}; $1 > d1' /var/www/logs/php/php7.3-fpm.log | grep "max_children"

，但如果我将其替换为-10000分钟，它会显示当前文件中的所有日志。日志格式如下。

[24-Jan-2021 03:28:09] WARNING: [pool cormier] server reached max_children setting (10), consider raising it
[24-Jan-2021 07:25:34] WARNING: [pool cormier] server reached max_children setting (10), consider raising it
[24-Jan-2021 17:00:52] WARNING: [pool cormier] server reached max_children setting (10), consider raising it
[24-Jan-2021 17:18:07] WARNING: [pool cormier] server reached max_children setting (10), consider raising it
[24-Jan-2021 21:11:06] WARNING: [pool cormier] server reached max_children setting (10), consider raising it
[24-Jan-2021 21:54:27] WARNING: [pool cormier] server reached max_children setting (10), consider raising it
[25-Jan-2021 01:24:12] WARNING: [pool cormier] server reached max_children setting (10), consider raising it
[25-Jan-2021 13:24:12] WARNING: [pool cormier] server reached max_children setting (10), consider raising it```

Answer 1

使用GNU awk:

awk 'BEGIN { map["Jan"]="01";map["Feb"]="02";map["Mar"]="03";map["Apr"]="04";map["May"]="05";map["Jun"]="06";map["Jul"]="07";map["Aug"]="08";map["Sep"]="09";map["Oct"]="10";map["Nov"]="11";map["Dec"]="12";} { dat=substr($1,9,4)" "map[substr($1,5,3)]" "substr($1,2,2);gsub("]"," ",$2)gsub(":"," ",$2);if ((systime() - mktime(dat" "$2))<=60) { print $0 } }' logfile

解释:

awk 'BEGIN {                                                    # create an array map with month (short terms) to month numbers
map["Jan"]="01";
map["Feb"]="02";
map["Mar"]="03";
map["Apr"]="04"; 
map["May"]="05";
map["Jun"]="06";
map["Jul"]="07";
map["Aug"]="08";
map["Sep"]="09";
map["Oct"]="10";
map["Nov"]="11";
map["Dec"]="12";
} 
{ 
dat=substr($1,9,4)" "map[substr($1,5,3)]" "substr($1,2,2);     # Create a variable dat with date in a format that can be converted to epoch format
gsub("]"," ",$2);                                              # Convert time to format that can be converted to epoch format with mktime function
gsub(":"," ",$2);
if ((systime() - mktime(dat" "$2))<=600) { 
print                                                       # If difference between epoch time now (systime) and epoch time of first and second fields is less than or greater than 60, print.
} 
}' logfile