微秒 毫秒
datetime
seek定位指針
從行尾到行首
fd.seek(-2,1) 1 目前位置
fd.tell()
fd.seek(-2,2) 2 最後位置
fd.tell()
fd.seek(0,0) 0 最前位置
read(1)讀一位 read() 全部都讀
tac與cat 行首到行尾
reversed 翻轉字元串
隻讀一部分 通過時間判斷
200 404 503 十分鐘之内 第八列 apache.log
1.首先比對時間格式，
DELTA = datetime.timedelta(minutes=3)
starttime = datetime.datetime.now() - DELTA
解決十分鐘問題
2.從後往前讀
3.第八列
line = [''] 清單裡面是空值
os.SEEK_END
re.findall(r'[^\n]*\n?',s)
re.findall 傳回是清單
python 日志搜集插件
diamond 搜集日志工具
搜集網絡，搜集CPU，搜集記憶體#!/usr/bin/env python
import time,datetime
import re
REG_SYSLOG =re.compile(r'(?P\w+ \d+ [\d:]+) (?P[\d\w.]+) (?P\w+)(\[\d*\])?:(?P.*)')
"""
GMT_FORMAT = '%b %d %H:%M:%S GMT'
datetime.datetime.utcnow().strftime(GMT_FORMAT)
now = datetime.datetime.now()
delta = datetime.timedelta(minutes=3)
threeago = now - delta
log = open('/var/log/messages').read()
nagioslog = log.startswith()
print nagioslog
"""
DELTA = datetime.timedelta(minute=3)
PROG_COUNTER = {}
KEYWORD = ['error','fatal']
def parsertime(s):
month,day,t = s.split()
hour,minute,second = [int(i) for i in t.split(':')]
return datetime.datetime(2014,MONTH_MAPPING[month])
def count(metric):
if metric in PROG_COUNTER:
PROG_COUNTER[metric] += 1
else:
PROG_COUNTER[metric] = 1
def getMessages():
starttime = datetime.datetime.now - DELTA
logfile ='/var/log/messages'
with open(logfile) as fd:
for line in fd:
logmatch = REG_SYSLOG.match(line)
if logmatch:
logdict = logmatch.groupdict()
logtime = parsetime(logdict['logtime'])
if logtime >= starttime:
count(logdict['progname'])
for k in KEYWORD:
if k in logdict['msg'].lower():
count(k,KEYWORD_COUNTER)
def check_counter():
if PROG_COUNTER:
for c in PROG_COUNTER:
if PROG_COUNTER[c] > 2:
print "Crital: prog %s has reached %s " % (c,PROG_COUNTER[c])
status = 2
elif PROG_COUNTER[c] <= 2:
print "Warning:prog %s has reached %s " (c,PROG_COUNTER[c])
status = 1
if KEYWORD_COUNTER:
status = 2
print "Crital:keywords have reached
if __name__ == '__main__':
getMessages()
"""
month,day,t = 'Apr 19 06:28:39'.split()
hour,minute,second = t.split(':')
datetime.datetime(2014,{'Apr':4}[month],int(day),int(hour),int(minute),int(second))
hour,minute,second = [int(i) for i in t.split(':')]
"""