$day = get-date -format ‘dd‘ $bday = $day-1 $btime = get-date -format yyyy-M- $qtime = $btime+$bday $htime = get-date -format yyyy-M-d $a = ‘T00:00:00‘ $b = ‘T23:59:00‘ $A = $qtime+$a $B = $htime+$b get-eventlog -logname system -after $A -before $B | where {$_.eventID -eq 1} | Format-List

使用salt分发time.ps1文件到各Windows sever中：copydir.sls

copy_dir: file.managed: - name: C:\opstools\time.ps1 - source: salt://zhouz/time.ps1 - makedirs: ‘True‘ cmd.run: - name: powershell.exe C:\opstools\time.ps1

使用脚本收集日志并分析

#!/bin/bash # fdir="/tmp/first" sdir="/tmp/second" tdir="/tmp/third" fodir="/tmp/forth" ColLogs() { echo "收集原始系统日志：" [ -d $fdir ] && rm -rf $fdir && mkdir $fdir || mkdir $fdir #weblist=`salt "主机名" test.ping | grep -v "True" | awk -F ‘:‘ ‘{print $1}‘` #list="`salt "主机名" test.ping | grep -v "True" | awk -F ‘:‘ ‘{print $1}‘ | xargs echo`" list="`salt "主机名" test.ping | grep -v "True" | xargs echo | sed "s/://g"`" for i in $list; do salt "$i" state.sls zhouz.copydir &> $fdir/$i echo "$i is ok" done } TreatLogsA() { echo "整理初始化日志(为对比天、小时、分钟、秒钟等字符串是否一致做准备)：" [ -d $tdir ] && rm -rf $tdir && mkdir $tdir || mkdir $tdir cd $fdir for i in $(ls BX*); do grep -A 1 ReplacementStrings $i | xargs echo >$tdir/$i cd $tdir sed -i ‘s/--/&\n/g‘ $i sed -i ‘s/--\|{\|}\|[[:space:]]//g‘ $i #sed -i ‘s/,/ /g‘ $i sed -i ‘s/,/\./g‘ $i sed -i ‘s/Z//g‘ $i #sed -i ‘s/\./:/g‘ $i sed -i ‘s/ReplacementStrings://g‘ $i #sed -i ‘s/T/:/g‘ $i #sed -i ‘s/2019-07-[0-9][0-9]T//g‘ $i #sed -i ‘s/\.[0-9]\{4,10\}Z//g‘ $i echo "$i is ok" cd $fdir done } TreatLogsB() { echo "对收集的初始系统日志进行整理(为对比 毫秒差值 做准备)：" [ -d $sdir ] && rm -rf $sdir && mkdir $sdir || mkdir $sdir cd $fdir for i in $(ls BX*); do grep -A 1 "ReplacementStrings" $i | xargs echo >$sdir/$i cd $sdir sed -i ‘s/--/&\n/g‘ $i sed -i ‘s/--\|{\|}\|[[:space:]]\|Z//g‘ $i sed -i ‘s/,/:/g‘ $i sed -i ‘s/\,\ 1//g‘ $i # sed -i ‘s/\./:/g‘ $i 此处将 . 去掉 sed -i ‘s/\.//g‘ $i sed -i ‘s/ReplacementStrings://g‘ $i sed -i ‘s/T/:/g‘ $i # sed -i ‘s/2019-07-[0-9][0-9]T//g‘ $i echo "$i is ok" cd $fdir done } TreatLogsC() { echo "对收集的初始系统日志进行整理(为对比 秒差值 做准备)：" [ -d $fodir ] && rm -rf $fodir && mkdir $fodir || mkdir $fodir cd $fdir for i in $(ls BX*); do grep -A 1 ReplacementStrings $i | xargs echo >$fodir/$i cd $fodir sed -i ‘s/--/&\n/g‘ $i sed -i ‘s/--\|{\|}\|[[:space:]]\|Z//g‘ $i sed -i ‘s/,/:/g‘ $i sed -i ‘s/\./:/g‘ $i #sed -i ‘s/\.//g‘ $i sed -i ‘s/ReplacementStrings://g‘ $i sed -i ‘s/T/:/g‘ $i #sed -i ‘s/2019-07-[0-9][0-9]T//g‘ $i echo "$i is ok" cd $fdir done } LogsDay() { echo "对比两列数据中秒钟是否一致：" cd $fodir mkdir $fodir/dtime &>/dev/null for i in $(ls BX*); do #cat $i | awk -F ":" ‘{print $1,":"$2,":"$3,($4-$9)}‘ >$fodir/dtime/$i cat $i | awk -F ":" ‘{print ($4-$9)}‘ >$fodir/dtime/$i cd $fodir/dtime #count=`grep -E -v "0|1" $i | wc -l` count=`grep -E -v "0" $i | wc -l` if [ $count -ge 1 ]; then echo "$i have problem" grep -v ‘0‘ $i else echo "$i is ok" fi cd $fodir done } DisTimePeriodA() { echo "对比天、小时、分钟、秒钟等字符串是否一致(批量)" cd $tdir mkdir $tdir/dtime &>/dev/null read_file=‘BX*‘ for file in ${read_file}; do echo "$file" for ((i=1;i<=$(cat $file| wc -l);i++)); do #first="$(sed -n ${i}p $file| awk ‘{print $1}‘)" first="$(sed -n ${i}p $file| awk -F "." ‘{print $1}‘)" #second="$(sed -n ${i}p $file | awk ‘{print $2}‘)" second="$(sed -n ${i}p $file | awk -F "." ‘{print $3}‘)" #echo "${first}" #echo "${second}" if [ "${first}" == "${second}" ]; then echo "${first} = ${second}" &>/dev/null else A="$(grep $first $file)" #B="$(grep $second $file)" #echo " ${first} != ${second}" echo " ${A}" fi done echo " " done } DisTimePeriodB() { echo "对比天、小时、分钟、秒钟等字符串是否一致(只查询有问题的主机)" cd $tdir mkdir $tdir/dtime &>/dev/null #read_file=‘BX*‘ #for file in ${read_file}; do read -p "请输入有问题的主机名： " file echo "$file" >>$tdir/dtime/$file for ((i=1;i<=$(cat $file| wc -l);i++)); do #first="$(sed -n ${i}p $file| awk ‘{print $1}‘)" first="$(sed -n ${i}p $file| awk -F "." ‘{print $1}‘)" #second="$(sed -n ${i}p $file | awk ‘{print $2}‘)" second="$(sed -n ${i}p $file | awk -F "." ‘{print $3}‘)" if [ "${first}" == "${second}" ]; then echo "${first} = ${second}" &>/dev/null else #echo " ${first} != ${second}" >>$tdir/dtime/$file A="$(grep $first $file)" echo " ${A}" fi # echo " " >>$tdir/dtime/$file done #done } LogsMillisecond() { echo "对比两列数据中 毫秒 是否一致：" cd $sdir mkdir $sdir/mtime &>/dev/null for i in $(ls BX*); do cat $i | awk -F ":" ‘{print $1,":"$2,":"$3,($4-$8)}‘ | sort -t $‘ ‘ -k4 -n >$sdir/mtime/$i cd $sdir/mtime echo "==================================================" echo "$i 两列毫秒为正数的数值最高的10个" cat $i |tail #echo "==================================================" #echo "$i 两列毫秒为正数的数值最小的10个" #cat $i |grep -v ‘\-[0-9][0-9][0-9][0-9][0-9]‘ |head -15 echo "==================================================" echo "$i 两列毫秒为负数的数值最大的10个" cat $i |grep ‘\-[0-9][0-9][0-9][0-9]‘ | head #echo "==================================================" #echo "$i 两列毫秒为负数的数值最小的10个" #cat $i |grep ‘\-[0-9][0-9][0-9][0-9]‘ | tail cd $sdir done } #ColLogs a="ColLogs" b="TreatLogsA" c="TreatLogsB" d="TreatLogsC" e="LogsDay" f="DisTimePeriodA" g="DisTimePeriodB" h="LogsMillisecond" echo "请选择你想要执行的功能: a: ColLog 收集windows server初始日志; b: TreatLogsA 整理初始化日志(为对比天、小时、分钟、秒钟等字符串是否一致做准备); c: TreatLogsB 整理初始化日志(为对比 毫秒 差值做准备); d: TreatLogsC 整理初始化日志(为对比 秒 差值做准备); e: LogsDay 对比两列数据中<< 秒 >>是否一致; f: DisTimePeriodA 对比天、小时、分钟、秒钟等字符串是否一致(批量显示); g: DisTimePeriodB 对比天、小时、分钟、秒钟等字符串是否一致(只查询有问题的主机); h: LogsMillisecond 对比两列数据中<< 毫秒 >>是否一致." read -n3 -p "请输入：" opt case $opt in a) $a ;; b) $b ;; c) $c ;; d) $d ;; e) $e ;; f) $f ;; g) $g ;; h) $h ;; *) echo "No opt" exit 1 esac