#!/usr/local/bin/gawk -f BEGIN { for(i = 1; i < ARGC; i++) { if(ARGV[i] == "help") Usage() if(ARGV[i] == "full") { full = 1 ARGV[i] = "" } if(ARGV[i] == "label") { label = 1 ARGV[i] = "" } if(ARGV[i] == "today") { startstring = "today" ARGV[i] = "" } if(substr(ARGV[i], 1, 6) == "start:") { startstring = substr(ARGV[i], 7) ARGV[i] = "" } if(substr(ARGV[i], 1, 5) == "stop:") { stopstring = substr(ARGV[i], 6) ARGV[i] = "" } } ONEDAY = 86400 # number of seconds in a day if(startstring == "today") { starttime = mktime(strftime("%Y %m %d 0 0 0", systime())) # 12am stoptime = starttime + ONEDAY # 12am tomorrow } else { if(startstring) starttime = mktime(startstring) else starttime = mktime(strftime("%Y %m %d 0 0 0", systime() - ONEDAY)) # 12am yesterday if(stopstring) stoptime = mktime(stopstring) else stoptime = starttime + ONEDAY # 12am (today) } months["Jan"] = 1 months["Feb"] = 2 months["Mar"] = 3 months["Apr"] = 4 months["May"] = 5 months["Jun"] = 6 months["Jul"] = 7 months["Aug"] = 8 months["Sep"] = 9 months["Oct"] = 10 months["Nov"] = 11 months["Dec"] = 12 } !pswitch && NF != 5 { next } # slight performance boost !pswitch && NF == 5 && $5 ~ /^[12][[:digit:]][[:digit:]][[:digit:]]$/ { mytime = substr($4, 1, 2) " " substr($4, 4, 2) " " substr($4, 7) lastseentime = mktime($5 " " months[$2] " " $3 " " mytime) if(lastseentime >= starttime && lastseentime < stoptime) pswitch = 1 } pswitch && NF == 5 && $5 ~ /^[12][[:digit:]][[:digit:]][[:digit:]]$/ { mytime = substr($4, 1, 2) " " substr($4, 4, 2) " " substr($4, 7) lastseentime = mktime($5 " " months[$2] " " $3 " " mytime) if(lastseentime >= stoptime) { pswitch = 0 nextfile } } pswitch && full { if(label == 1) print FILENAME ": " $0 else print next } pswitch && index($0, "ORA-") { label ? error[FILENAME ": " $0]++ : error[$0]++ } END { if(!full) for(i in error) print i " {" error[i] "}" } function P(line) { print line } function Usage() { # Under mawk, you can get the real name. if(ARGV[0] ~ /gawk(.exe)?$/) name = "alertscan" else name = ARGV[0] P("\n" name " - Oracle alert log scanner (Requires GNU AWK.)\n") P("Extracts Oracle alert log entries that lie in specific date ranges. By") P("default, extracts only unique lines containing the string \"ORA-\" that") P("occurred on the previous day, plus a count. Other options:\n") P("\tfull - print the full contents of the alert log, not just ORA- lines") P("\tlabel - prefix the filename on all lines") P("\tstart:YYYY MM DD HH MM SS[ DST] - start time (see gawk mktime docs)") P("\tstop:YYYY MM DD HH MM SS[ DST] - stop time") P("\ttoday - show today's log\n") P("Examples:") P("\tPrint yesterday's errors:") P("\t" name " alert_orcl.log\n") P("\tPrint everything logged today:") P("\t" name " full today alert_orcl.log\n") P("\tPrint all errors in 2003:") P("\t" name " \"start:2003 1 1 0 0 0\" \"stop:2004 1 1 0 0 0\" alert_orcl.log") exit }