I have a problem: very fast moving logs that I want to monitor in realtime for various "tokens". I asked on #perl if anyone knew of a standard tool (like `watch` or `tail`) that could do this but nobody did, so I wrote this:
#!/usr/bin/perl -w
use strict;
use Getopt::Long;
use Time::HiRes qw(time);
my @Watches;
my $interval = 1;
GetOptions("watch=s" => \@Watches, "interval=i" => \$interval);
print "Watching logs every $interval seconds\n";
$|++;
my $secs = 0;
my $total = 0;
my @counts = (0 x @Watches);
my $tzero = time;
my $t0 = time;
while (<>) {
$total++;
for my $i (0.. $#Watches) {
if (index($_, $Watches[$i]) >= 0) {
$counts[$i]++;
}
}
my $curtime = time;
my $diff = $curtime - $t0;
if ($diff >= $interval) {
$t0 = $curtime;
printf "\rLines/s: %0.2f", ($total / $diff);
$total = 0;
if (@Watches) {
for my $i (0.. $#Watches) {
printf ", $Watches[$i]/s: %0.2f", ($counts[$i] / $diff);
$counts[$i] = 0;
}
}
# fixme - don't use fixed num of spaces here
print " ";
}
}
Run it without any options to get the number of log lines per second (pipe the logs in with tail -f) or pass in --watch FOO to count the lines containing the string "FOO".
Have you seen sec? (Score:1)
curious (Score:2)
Re:curious (Score:2)
sounds like snort (Score:1)