在我的 RHEL6 系统上,我能够执行以下查询来获得我正在寻找的输出:
cat /var/log/messages* | egrep -i 'usb [0-9]-|mounted|logical blocks' > ${USBDATA}
cat ${USBDATA} | grep "New USB device found" > ${NewUSBDev}
while read line; do
MONTH="`echo ${line} | awk '{print $1}'`" ; # -- Jul
DAY="`echo ${line} | awk '{print $2}'`" # -- day_
HOUR="`echo ${line} | awk '{print $3}' | cut -d':' -f1`:" # -- hour:
MIN="`echo ${line} | awk '{print $3}' | cut -d':' -f2`:" # -- hour:
# -- echo "M:[$MONTH] D:[$DAY] H:[${HOUR}${MIN}]"
cat ${USBDATA} | grep ${MONTH} | grep "${DAY} ${HOUR}${MIN}" > ${CHUNK}
awk '/New USB device found/{p++}p==1' ${CHUNK} > ${TMPFILE}
cp ${TMPFILE} ${CHUNK}
if [ "$(cat $CHUNK| egrep 'MiB|GiB|TiB')" ] && ! [ "$(cat $CHUNK | grep 'Mounted root filesystem')" ] ;then
# -- cat ${CHUNK}
STR="$(less ${CHUNK}|grep 'idProduct' | head -1 | awk '{print $1" "$2" "$3" "$12" "$13}')"
STR="$STR $(less ${CHUNK}|grep 'Product:' | awk '{print ", "$9" "$10" "$11}')"
STR="$STR $(less ${CHUNK}|grep 'Manufacturer:' | awk '{print ", "$9" "$10" "$11}')"
STR="$STR $(less ${CHUNK}|grep 'SerialNumber:' | awk '{print ", "$9}')"
STR="$STR $(less ${CHUNK}|grep 'logical blocks:' | head -1 | awk '{print ", "$13" "$14" "$15" "}')"
echo "${STR}"
echo "${STR}" >> ${DEVICES}
fi
[ -f ${CHUNK} ] && rm ${CHUNK}
done < ${NewUSBDev}
echo "----------------------------------------------"
cat ${DEVICES} | sort -M -k 2 > ${SORTEDDEV}
cat ${SORTEDDEV}
基本上,它有点难看,但它会搜索所有“找到的新 USB 设备”并列出包含它的行。然后取出与该时间戳匹配的所有内容。然后在“找到新的 USB 设备”之前提取所有内容,并在“找到新的 USB 设备”进行第二次匹配之后提取所有内容。
样本 ${CHUNK} 的数据如下所示:
Sep 30 09:55:10 oc7446274465 kernel: usb 2-1: New USB device found, idVendor=1058, idProduct=071a
Sep 30 09:55:10 oc7446274465 kernel: usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
Sep 30 09:55:10 oc7446274465 kernel: usb 2-1: Product: My Passport 071A
Sep 30 09:55:10 oc7446274465 kernel: usb 2-1: Manufacturer: Western Digital
Sep 30 09:55:10 oc7446274465 kernel: usb 2-1: SerialNumber: 575846314136304130353235
Sep 30 09:55:10 oc7446274465 kernel: usb 2-1: configuration #1 chosen from 1 choice
Sep 30 09:55:22 oc7446274465 kernel: sd 5:0:0:0: [sdb] 1465092096 512-byte logical blocks: (750 GB/698 GiB)
将此数据放入临时文件中,然后 grep 出重要位。可以肯定地对此进行改进,但目前可以使用(上述代码中未包含 grepping 部分):
样本输出:
Sep 10 16:19:14 idVendor=8564, idProduct=1000 , Mass Storage Device , JetFlash , 2978449637 , (31.6 GB/29.4 GiB)
Sep 14 15:15:04 idVendor=054c, idProduct=0544 , DSC-HX9V , Sony , D89BE0866 , (20.0 MB/19.1 MiB)
Sep 17 19:38:04 idVendor=054c, idProduct=0544 , DSC-HX9V , Sony , D89BE0866 , (31.9 GB/29.7 GiB)
Sep 19 05:23:07 idVendor=054c, idProduct=0544 , DSC-HX9V , Sony , D89BE0866 , (31.9 GB/29.7 GiB)
Sep 30 09:55:10 idVendor=1058, idProduct=071a , My Passport 071A , Western Digital , 57584631413630XXXXXX235 , (750 GB/698 GiB)
因此我得到了时间、ID 信息、产品名称、序列号等。我可能应该包括检查数据是否丢失。但你明白了。感谢您的输入。