用于日志分析的模式匹配

我的程序将发出一个grep命令来搜索日志基于时间范围和唯一关键字。我的计划能够成功发行了grep命令，它的返回日志的几个匹配的线看起来像下面

用于日志分析的模式匹配

22:41.9 INFO SSHD SSHD-TRANSFER-1 [accountName=root] [remoteAddress=/172.16.8.1:64931]:Logout agent success [accountName=null remoteAddress=STEDGE/172.16.8.3] AuthenticationProviderImpl.java com.tumbleweed.st.server.sshd.AuthenticationProviderImpl executeLogoutAgent 429 UNKNOWN UNKNOWN UNKNOWN UNKNOWN UNKNOWN UNKNOWN UNKNOWN UNKNOWN 
21:45.9 INFO SSHD SSHD-TRANSFER-1 [accountName=root] [remoteAddress=/172.16.8.1:64931]:Invoking logout agent [accountName=null remoteAddress=STEDGE/172.16.8.3] AuthenticationProviderImpl.java com.tumbleweed.st.server.sshd.AuthenticationProviderImpl executeLogoutAgent 425 UNKNOWN UNKNOWN UNKNOWN UNKNOWN UNKNOWN UNKNOWN UNKNOWN UNKNOWN 
21:45.9 INFO SSHD SSHD-TRANSFER-1 [accountName=root] [remoteAddress=/172.16.8.1:64931]:SSH: User "null" logged out from [172.16.8.1]. AuthenticationProviderImpl.java com.tumbleweed.st.server.sshd.AuthenticationProviderImpl executeLogoutAgent 422 UNKNOWN UNKNOWN UNKNOWN UNKNOWN UNKNOWN UNKNOWN UNKNOWN UNKNOWN

但我不需要这一切，这个事情我感兴趣的是[remoteAddress=/172.16.8.1:64931]。这行代码Pattern pat1 = Pattern.compile("remoteAddress=/(\d)");给予非法转义字符。我可以知道如何只提取出没有任何端口号的IP地址并将其存储到一个字符串变量中，我搜索了一些关于谷歌的信息，但它失败了吗？对于您参考，这是我的源代码

import java.io.*; 
import java.util.regex.*; 
class blockIP 
{ 
    public static void main(String [] args) 
    { 
    String command1 = "date +%R"; 
    String time = null; 
    String arguement2 = null; 
    String arguement1 = ".*java"; 
    try 
     { 
      Process p1 = Runtime.getRuntime().exec(command1); 
      BufferedReader br1 = new BufferedReader(new InputStreamReader(p1.getInputStream())); 

      String line1; 
      while((line1 = br1.readLine()) != null) 
       { 
        System.out.println(line1); 
        time = line1; 
        arguement2 =time.concat(arguement1); 
       } 
      br1.close(); 
      String command2 = "grep "+arguement2+" stlog.txt"; 
      System.out.println("the command2 is :"+command2); 
      Process p2 = Runtime.getRuntime().exec(command2); 
      BufferedReader br2 = new BufferedReader(new InputStreamReader(p2.getInputStream())); 
      String line2; 
      while((line2 = br2.readLine()) != null) 
      { 
       System.out.println(line2); 
       Pattern pat1 = Pattern.compile("remoteAddress=/(\d)"); 
       Matcher matcher1 = pat1.matcher(line2); 
       while(matcher1.find()) 
        { 
        System.out.println(matcher1.group(1)); 
        } 
      } 

     } 
     catch(IOException e) 
     { 
     e.printStackTrace(); 
     } 

    } 
}

来源

2017-05-30 attack

我不喜欢你如何拼写“论点” –

此正则表达式后remoteAddress=/短语匹配的数字和点。

public static void main(String[] args) { 
     String s = "21:45.9 INFO SSHD SSHD-TRANSFER-1 [accountName=root] [remoteAddress=/172.16.8.1:64931]:Invoking logout agent [accountName=null remoteAddress=STEDGE/172.16.8.3] AuthenticationProviderImpl.java com.tumbleweed.st.server.sshd.AuthenticationProviderImpl executeLogoutAgent 425 UNKNOWN UNKNOWN UNKNOWN UNKNOWN UNKNOWN UNKNOWN UNKNOWN UNKNOWN\r\n"; 
     Pattern pattern = Pattern.compile("(?<=remoteAddress=/)[\\d.]+"); 
     Matcher matcher = pattern.matcher(s); 
     while (matcher.find()) { 
      String group = matcher.group(); 
      System.out.println(group); 
     } 

    }

它不会匹配remoteAddress=STEDGE/172.16.8.3。

它使用正回顾后断言(?<=remoteAddress=/)是前172.16.8.1

图样：

(?<=remoteAddress=/)正回顾后（零长度断言）。只有在[\\d.]+前面有精确短语remoteAddress=/时，才匹配。

[\\d.]+匹配数字或句点。一次或更多次。不匹配其他任何东西。

来源

2017-05-30 06:21:29

非常感谢，它按预期工作，但你能帮我理解你设定的模式吗？ – attack

尝试grep的使用后剪切命令。喜欢的东西：

grep argument stlog.txt | cut -d ' ' -f 6

参考https://shapeshed.com/unix-cut/

来源

2017-05-30 06:21:05

感谢您的指导。学到了新东西 – attack

用于日志分析的模式匹配

回答

相关问题