#!/bin/sh
gawk '
BEGIN {
FS= "[ \t:]+" #define the separator
ARGC = 2 #to cheat the awk ,避免报错提示!!
# extract log begin time
begin_year = substr( ARGV[2],1,4)
begin_month = substr(ARGV[2] ,6,2)
begin_day = substr( ARGV[2], 9,2)
begin_hour = substr( ARGV[2],12,2)
begin_minute = substr( ARGV[2],15 ,2)
#begin time
startlogtime = mktime(" "begin_year" "begin_month" "begin_day" "begin_hour" "begin_minute" 00 " )
print startlogtime
# extract log end time
end_year = substr( ARGV[3],1,4)
end_month = substr(ARGV[3] ,6,2)
end_day = substr( ARGV[3], 9,2)
end_hour = substr( ARGV[3],12,2)
end_minute = substr( ARGV[3],15 ,2)
endlogtime = mktime(" "end_year" "end_month" "end_day" "end_hour" "end_minute" 60 " )
print endlogtime
}
{
# change the month format to number
num_month = abbmonth2num( $2 )
timestamp = mktime(" "substr( $8,1,4)" "num_month" "$3" "$4" "$5" "$6" " )
#*********Edit**userid***Here************
if ( startlogtime < timestamp && timestamp < endlogtime && 0 != match( $0, /exp/ ) )
print $0 > "userid.log"
}
END {
close("userid.log")
}
#abbmonth2num function def
#change abb month to its number
function abbmonth2num( abbstr_month )
{
switch ( abbstr_month )
{
case "Jan":
num_month = 1
break
case "Feb":
num_month = 2
break
case "Mar":
num_month = 3
break
case "Apr":
num_month = 4
break
case "May":
num_month = 5
break
case "Jun":
num_month = 6
break
case "Jul":
num_month = 7
break
case "Aug":
num_month = 8
break
case "Sep":
num_month = 9
break
case "Oct":
num_month = 10
break
case "Nov":
num_month = 11
break
case "Dec":
num_month = 12
break
default:
num_month = -1
break
}
return num_month
} # end abbmonth2num function def
' $*
|