您在问题中提到,即使您只发布了一个日志文件,也有两个日志文件。因此,我将以您的输入数据为例,向您展示如何通过自己的方式找到解决方案。
根据新的示例数据更新了解决方案。
使用的样本数据:
$ cat first
824597 1371853829 /home/customer1/ITAM.xml
4824597 1371854003 /home/customer46/ITAM.xml
$ cat second
4824597 1371854003 /home/customer1/ITAM.xml
4824597 1371854003 /home/customer46/ITAM.xml
我添加了注释以使其更容易理解。
script.awk 的内容:
# This syntax in combination with next (seen below) allows us to work on the first file
# entirely
NF==FNR {
# we are indexing the filename and assign it start time value
start[$3]=$2
# next allows us to skip the rest action statements
next
}
# once the first log file is looped over we store the second log file in end array
{
end[$3]=$2
}
# End block is where we are doing most of our computation since we have scanned
# through the two files and now are ready to calculate the difference
END {
# we iterate over the start array and pick an index value (that is a file)
for (filestart in start) {
# we do the same for our second array
for (fileend in end) {
# if the filename are same then we are ready to do the difference
if (filestart == fileend) {
# we subtract start time from end time
diff = end[fileend] - start[filestart];
# we use sprintf function to avoid printing the difference so that we can store it in a variable
diff = sprintf("%dh:%dm:%ds",diff/(60*60),diff%(60*60)/60,diff%60)
# we print the filename and the time lag
print filestart,diff
# we delete the filename indices to reduce the size of array for performance reasons
delete start[filestart]
delete end[fileend]
}
}
}
}
以以下方式运行脚本awk -f script.awk log.file
或以以下方式运行脚本:
$ awk '
NR==FNR {
start[$3]=$2
next
}
{
end[$3]=$2
}
END {
for(filestart in start) {
for(fileend in end) {
if (filestart == fileend) {
diff = end[fileend] - start[filestart];
diff = sprintf("%dh:%dm:%ds",diff/(60*60),diff%(60*60)/60,diff%60)
print filestart,diff
delete start[filestart]
delete end[fileend]
}
}
}
}' first second
/home/customer46/ITAM.xml 0h:0m:0s
/home/customer1/ITAM.xml 0h:2m:54s