#!/usr/local/bin/gawk -f

BEGIN {
	for(i = 1; i < ARGC; i++)
	{
		if(ARGV[i] == "help") Usage()

		if(ARGV[i] == "full")
		{
			full = 1
			ARGV[i] = ""
		}

		if(ARGV[i] == "label")
		{
			label = 1
			ARGV[i] = ""
		}

		if(ARGV[i] == "today")
		{
			startstring = "today"
			ARGV[i] = ""
		}

		if(substr(ARGV[i], 1, 6) == "start:")
		{
			startstring = substr(ARGV[i], 7)
			ARGV[i] = ""
		}

		if(substr(ARGV[i], 1, 5) == "stop:")
		{
			stopstring = substr(ARGV[i], 6)
			ARGV[i] = ""
		}
	}

	ONEDAY = 86400 # number of seconds in a day

	if(startstring == "today")
	{
		starttime = mktime(strftime("%Y %m %d 0 0 0", systime())) # 12am
		stoptime = starttime + ONEDAY # 12am tomorrow
	}
	else
	{
		if(startstring)
			starttime = mktime(startstring)
		else
			starttime = mktime(strftime("%Y %m %d 0 0 0",
				systime() - ONEDAY)) # 12am yesterday

		if(stopstring)
			stoptime = mktime(stopstring)
		else
			stoptime = starttime + ONEDAY # 12am (today)
	}

	months["Jan"] = 1
	months["Feb"] = 2
	months["Mar"] = 3
	months["Apr"] = 4
	months["May"] = 5
	months["Jun"] = 6
	months["Jul"] = 7
	months["Aug"] = 8
	months["Sep"] = 9
	months["Oct"] = 10
	months["Nov"] = 11
	months["Dec"] = 12
}

!pswitch && NF != 5 { next } # slight performance boost

!pswitch && NF == 5 && $5 ~ /^[12][[:digit:]][[:digit:]][[:digit:]]$/ {

	mytime = substr($4, 1, 2) " " substr($4, 4, 2) " " substr($4, 7)

	lastseentime = mktime($5 " " months[$2] " " $3 " " mytime)

	if(lastseentime >= starttime && lastseentime < stoptime) pswitch = 1
}

pswitch && NF == 5 && $5 ~ /^[12][[:digit:]][[:digit:]][[:digit:]]$/ {

	mytime = substr($4, 1, 2) " " substr($4, 4, 2) " " substr($4, 7)

	lastseentime = mktime($5 " " months[$2] " " $3 " " mytime)

	if(lastseentime >= stoptime)
	{
		pswitch = 0
		nextfile
	}
}

pswitch && full {

	if(label == 1) print FILENAME ": " $0
	else print

	next
}

pswitch && index($0, "ORA-") {

	label ? error[FILENAME ": " $0]++ : error[$0]++
}

END {
	if(!full)
		for(i in error)
			print i " {" error[i] "}"
}


function P(line)
{
	print line
}


function Usage()
{

# Under mawk, you can get the real name.

if(ARGV[0] ~ /gawk(.exe)?$/) name = "alertscan"
	else name = ARGV[0]

P("\n" name " - Oracle alert log scanner (Requires GNU AWK.)\n")
P("Extracts Oracle alert log entries that lie in specific date ranges. By")
P("default, extracts only unique lines containing the string \"ORA-\" that")
P("occurred on the previous day, plus a count. Other options:\n")
P("\tfull - print the full contents of the alert log, not just ORA- lines")
P("\tlabel - prefix the filename on all lines")
P("\tstart:YYYY MM DD HH MM SS[ DST] - start time (see gawk mktime docs)")
P("\tstop:YYYY MM DD HH MM SS[ DST] - stop time")
P("\ttoday - show today's log\n")
P("Examples:")
P("\tPrint yesterday's errors:")
P("\t" name " alert_orcl.log\n")
P("\tPrint everything logged today:")
P("\t" name " full today alert_orcl.log\n")
P("\tPrint all errors in 2003:")
P("\t" name " \"start:2003 1 1 0 0 0\" \"stop:2004 1 1 0 0 0\" alert_orcl.log")

	exit
}