shell日志分析脚本 

  1 #!/bin/bash
  2 ###########################################
  3 #
  4 #      version:    3.0.0
  5 #         creator:    zenghui       
  6 #         datetime:   05/06/2015
  7 #
  8 ###########################################
  9 #判断命令行参数
 10 if [ "$1" = "-f" ] && [ "$2" != "" ]
 11 then
 12 access_log="$2"
 13 
 14 #定义输入时间
 15 function feng() {
 16     read -p "请输入开始时间(10:30:00)秒数不输入默认为00: " a
 17     read -p "请输入结束时间(10:35:00)秒数不输入默认为00: " b
 18     if [[ "$a" =~ ^[0-9]{2}:[0-9]{2}:[0-9]{2}$ ]]
 19     then
 20         time_qing=`date +'['%d/%b/%Y:`$a
 21     else
 22         time_qing=`date +'['%d/%b/%Y:`$a":00"
 23     fi
 24 
 25     if [[ "$b" =~ ^[0-9]{2}:[0-9]{2}:[0-9]{2}$ ]]
 26     then    
 27         time_hou=`date +'['%d/%b/%Y:`$b
 28     else
 29         time_hou=`date +'['%d/%b/%Y:`$b":00"
 30     fi
 31     awk_value=`awk -v a=$time_qing -v b=$time_hou 'BEGIN{if (a>b) print "yes"}'`
 32 }
 33 
 34 #定义主菜单
 35 function menu() {
 36     clear
 37     echo -e "****************33[34;7m 日志统计33[0m*********************"
 38     echo "*            1、全站统计                    *"
 39     echo "*            2、以时间统计                  *"
 40     echo "*            3、exit                        *"
 41     echo "*********************************************"    
 42 }
 43 
 44 
 45 #定义全站统计共享函数
 46 function cmdquanz() {
 47         echo "$total"
 48         read -p "请输入编号显示ip的url记录: " totip
 49         tot=`echo "$total" | awk -v totip="$totip" '{if ($1 == totip) print $3}'`
 50     tempfile=`mktemp`
 51         temp1=`mktemp`
 52         temp2=`mktemp`
 53         echo $tempfile' '$temp1' '$temp2
 54         cat "$access_log" | awk -v tot=$tot '{if ($1 == tot) print $0}'> $tempfile
 55         awk '{print "33[31m "$7" 33[0m""33[32m "$10/1024/1024"MB 33[0m"}' $tempfile > $temp1
 56         awk -F'"' '{print "33[34m "$6" 33[0m"}' $tempfile > $temp2
 57         paste $temp1 $temp2 | sort | uniq -c | sort -nr |more
 58         #echo $tot
 59         #cat "$access_log" | awk -v tot=$tot '{if ($1 == tot) print $7}' | sort | uniq -c | sort -nr |more
 60         read -p "q退出上一级，Enter 继续" i
 61         if [ "$i" = "q" ];then
 62                 quanz
 63         else
 64                 clear
 65                 cmdquanz
 66         fi
 67 }
 68 
 69 #iptables函数
 70 function Iptables() {
 71     echo -e "*******************33[34;7m 功能选择33[0m******************"
 72     echo "*            1、显示ip的url、agent          *"
 73     echo "*            2、将ip加入iptables            *"
 74     echo "*            3、将ip加入nginx黑名单         *"
 75     echo "*            4、exit                        *"
 76     echo "*********************************************"
 77     read -p "请输入您要选择的编号： " Ipt
 78 }
 79 
 80 function Ima() {
 81     echo -e "*****************33[34;7m 功能选择33[0m****************************"
 82     echo  "*            1、单个ip加入nginx黑名单                *"
 83     echo  "*            2、全加入nginx黑名单                    *"
 84     echo  "*            3、回上一级                             *"
 85     echo  "*            4、exit                                 *"
 86     echo  "******************************************************"
 87     read -p "请输入您要选择的编号： " imge
 88 }
 89 
 90 #定义访问都是静态文件函数
 91 function Images() {
 92     read -p "输入你要查询的关键字(jpg,js,html)：" gjz
 93         feng
 94         jpg_ip=`cat /var/log/nginx/access_www.log |awk -v a=$time_qing -v b=$time_hou '{if ($4>a && $4<b) print $0}' | awk -v gjz=$gjz '{m[$1]=m[$1]+$10}{ipp[$1]=ipp[$1]+1}{if ($7 ~ gjz){a=1;ip[$1]=ip[$1]+a}}END{for(i in ip) if (ipp[i]==ip[i] && m[i]>1000000) print i,m[i]/1024/1024"MB"}' | sort -k 2 -nr | head -20 | cat -n`
 95     echo "$jpg_ip"
 96     Ima
 97     case $imge in
 98     1)
 99     read -p "再输入之前的ip编号(加入黑名单)：" imge_ip
100     tot=`echo "$jpg_ip" | awk -v im="$imge_ip" '{if ($1 == im) print $2}'`
101     nginx_black
102         read -p "Enter 继续"
103         shij;;
104     2)
105     read -p "确定请按Y/y：" ye
106     if [ "$ye" = "Y" ] || [ "$ye" = "y" ];then
107     shibai=`cat /usr/local/lnmp/nginx/conf/black.list`
108     chg=`echo "$jpg_ip" | awk '{print "deny "$2";"}' && cat /usr/local/lnmp/nginx/conf/black.list | sort | uniq | grep -v "58.247.43.226"`
109     echo "$chg" >  /usr/local/lnmp/nginx/conf/black.list
110          if [ "`/usr/local/lnmp/nginx/sbin/nginx -t > /dev/null 2>&1 && echo $?`" == "0" ];then
111                     /usr/local/lnmp/nginx/sbin/nginx -s reload  > /dev/null 2>&1
112                     echo "nginx 配置文件重新加载成功"
113                 else
114                     echo "nginx 配置文件重新加载失败"
115             echo "$shibai" > /usr/local/lnmp/nginx/conf/black.list
116         fi
117         fi
118     read -p "Enter 继续"
119     shij;;
120     3)
121     shij;;
122     *)
123     exit;;
124     esac
125 }
126 
127 ＃定义nginx黑名单
128 function nginx_black() {
129     nginx_black=/usr/local/lnmp/nginx/conf/black.list
130     if [ "$tot" != "" ];then
131         cat /usr/local/lnmp/nginx/conf/black.list | grep "$tot" || echo "deny $tot;">>$nginx_black
132        echo "$tot 已加入nginx黑名单"
133     if [ "`/usr/local/lnmp/nginx/sbin/nginx -t > /dev/null 2>&1 && echo $?`" == "0" ];then
134         /usr/local/lnmp/nginx/sbin/nginx -s reload  > /dev/null 2>&1
135         echo "nginx 配置文件重新加载成功"
136     else
137         echo "nginx 配置文件重新加载失败"
138     fi
139     fi
140 }
141 
142 #定义以时间统计共享函数
143 function cmdshij() {
144         echo "$total"
145         read -p "请输入编号: " totip
146         tot=`echo "$total" | awk -v totip="$totip" '{if ($1 == totip) print $3}'`   #获取ip
147     Iptables
148     
149     #对ip进行整理输出
150     case $Ipt in
151     1)
152         echo $tot' ptr'`dig -x $tot +short`
153     tempfile=`mktemp`
154     temp1=`mktemp`
155     temp2=`mktemp`
156     echo $tempfile' '$temp1' '$temp2
157     awk -v a=$time_qing -v b=$time_hou '{if ($4>a && $4<b) print $0}' "$access_log" | awk -v tot=$tot '{if ($1 == tot) print $0}'> $tempfile
158     awk '{print "33[31m "$7" 33[0m""33[32m "$10/1024/1024"MB 33[0m"}' $tempfile > $temp1
159     awk -F'"' '{print "33[34m "$6" 33[0m"}' $tempfile > $temp2
160     paste $temp1 $temp2 | sort | uniq -c | sort -nr |more
161     read -p "q退出上一级，Enter继续" i
162     if [ "$i" = "q" ];then
163         shij
164     else
165         clear
166         cmdshij
167     fi;;
168     2)
169     if [ "$tot" != "" ];then
170         iptables -L -n | grep "$tot" >/dev/null || iptables -I INPUT -s $tot -j DROP
171         echo "$tot 已加入iptables"
172     fi
173     read -p "q退出上一级，Enter继续" i
174         if [ "$i" = "q" ];then
175                 shij
176         else
177         clear
178                 cmdshij
179         fi;;
180     3)
181     nginx_black
182         read -p "q退出上一级，Enter继续" i
183         if [ "$i" = "q" ];then
184                 shij
185         else
186                 clear
187                 cmdshij
188         fi;;
189     *)
190     exit;;
191     esac
192 
193 }
194 
195 #定义全站统计函数
196 function quanz() {
197     clear
198     echo -e "****************33[34;7m全站统计33[0m*********************"
199     echo "*            1、以流量排序                  *"
200     echo "*            2、以ip个数排序                *"
201     echo "*            3、回上一级                    *"
202     echo "*            5、退出                        *"
203     echo "*********************************************"
204 read -p "请输入编号: " qz
205 case $qz in 
206     1)
207     total=`awk '{a[$1]=a[$1]+$10;++b[$1]}END{for(i in a)print a[i]/1024/1024"MB",i,b[i]}' "$access_log" | sort -nr | head -20| cat -n`
208     cmdquanz
209     quanz;;
210     2)
211     total=`awk '{a[$1]=a[$1]+$10;++b[$1]}END{for(i in a)print a[i]/1024/1024"MB",i,b[i]}' "$access_log" | sort -k 3 -nr | head -20| cat -n`
212     cmdquanz
213     quanz;;
214     3)
215     menu;;
216     *)
217     exit;;
218 esac
219 }
220 
221 #定义以时间统计函数
222 function shij() {
223     clear
224     echo -e "****************33[34;7m以时间统计33[0m*******************"
225     echo "*            1、以流量排序                  *"
226     echo "*            2、以ip个数排序                *"
227     echo "*            3、时间段ip总数                *"
228     echo "*            4、时间段全访问jpg or html     *"
229     echo "*            5、回上一级                    *"
230     echo "*            6、退出                        *"
231     echo "*********************************************"
232 read -p "请输入编号: " sj
233 case $sj in
234     1)
235     feng
236     if [ ${awk_value:-no} = "yes" ] || [ "$a" = "" ] || [ "$b" = "" ]
237     then
238         clear
239         echo "输入有误,请重新输入"
240         shij
241     else
242         total=`awk -v a=$time_qing -v b=$time_hou '{if ($4>a && $4<b) print $0}'  "$access_log"| awk '{a[$1]=a[$1]+$10;++b[$1]}END{for(i in a)print a[i]/1024/1024"MB",i,b[i]}' | sort -nr | head -20 | grep -v "e-" | cat -n`
243         cmdshij
244         shij
245     fi;;
246     2)
247         feng
248         if [ ${awk_value:-no} = "yes" ] || [ "$a" = "" ] || [ "$b" = "" ]
249         then
250         clear
251             echo "输入有误,请重新输入"
252             shij
253         else
254             total=`awk -v a=$time_qing -v b=$time_hou '{if ($4>a && $4<b) print $0}'  "$access_log"| awk '{a[$1]=a[$1]+$10;++b[$1]}END{for(i in a)print a[i]/1024/1024"MB",i,b[i]}' | sort -k 3 -nr | head -20| cat -n`
255         cmdshij
256             shij
257         fi;;
258     3)
259     feng
260     echo "ip总数: ""`awk -v a=$time_qing -v b=$time_hou '{if ($4>a && $4<b) print $0}'  "$access_log"| awk '{print $1}' | sort | uniq -c | wc -l`"
261     awk -v a=$time_qing -v b=$time_hou '{if ($4>a && $4<b) print $0}'  "$access_log"| awk '{print $1}' | sort | uniq -c | sort -nr |more 
262         read -p "Enter 继续"
263     shij;;
264     4)
265     Images;;
266     5)
267     menu;;
268     *)
269     exit;;
270 esac
271 }
272 
273 #循环显示
274 while true
275 do
276 menu
277 read -p "请输入编号： " bh
278 case $bh in
279     1)
280     quanz;;
281     2)
282     shij;;
283     *)
284     exit;;
285 esac
286 done
287 #初始化变量aa
288 elif [ "${aa:--h}" = "-h" ]
289 then
290     echo "运行: ./datalog_ip_sort.sh -f 日志文件"
291 fi

 

posted @ 2015-04-16 13:44  xiaohui163  阅读(375)  评论(0)    收藏  举报