这部分是以oralce的alert日志为例可以监控你想要监控的日志，用日志的完整路径替换oralce的日志路径就可以了
#!/bin/bash
rm /export/home/monitorsh/alertcom.log
#SERVERNAME
SERVERNAME=$(uname -a | awk '{ print $2}')
filename="/export/home/monitorsh/"$SERVERNAME"_DBSERVERLOGMONITOR.sql"
echo "connect user/password" >>${filename}
#要监控的日志，只对变化部分，写入记录，如果需要全文扫描，去掉下面nl和comm行，直接用要扫描的日志文件的绝对路径和文件名替换 alertcom1.log文件，sed行的替换就可以了，注意将文件中的特殊字符转换一下，否则可能出错;首次执行可能因为无历史文件参考而出错，第二 次执行则不会出错
#给日志文件加行标便于比较
nl /export/home/ oracle /admin/orcl/bdump/alert_orcl.log > /export/home/monitorsh/alertnew.log
#比较新日志和上一次统计时的日志，取出差异部分放入 alertcom1.log
comm -23 /export/home/monitorsh/alertnew.log /export/home/monitorsh/alertold.log> /export/home/monitorsh/alertcom1.log
#去掉文件中的特殊字符,图书字符在搜索关键字是可能会导致异常
sed "s/\'/\'\'\'\'/" /export/home/monitorsh/alertcom1.log >/export/home/monitorsh/alertcom.log
linkstring=$(echo "'||chr(13)||chr(10)||'")
while read line
do
keyword=$(echo ${line} | awk '{print $2}')
while read line2
do
#在文档中搜索关键字
keyline=$(echo ${line2} | grep ${keyword} | grep -v grep)
line2num=$(echo ${line2} | awk '{print $1}')
if [ -z "${keyline}" ]
then
echo "OK" >>/export/home/monitorsh/sql/getlog.log
else
LogContent1=$(echo ${line2})
#获得关键字所在行的行标和行内容
LogContent=$line2num"|""""$LogContent1"""
echo "insert into TAB_DBSERVERLOGMONITOR values ("$line2num","$SERVERNAME",'"$keyword"','"$LogContent"','o rac le',to_char(sysdate,'yyyymmddhh24miss'),to_char(sysdate,'yyyymmddhh24miss'));" >>${filename}
echo "commit;" >>${filename}
fi
done < /export/home/monitorsh/alertcom.log
done < /export/home/monitorsh/keyword.conf
rm /export/home/monitorsh/alertold.log
mv /export/home/monitorsh/alertnew.log /export/home/monitorsh/alertold.log
filename=$SERVERNAME"_DBSERVERLOGMONITOR.sql"
ftp -i -n 10.43.94.15 <<!
user user password
cd /export/home/monitorsh/sql
lcd /export/home/monitorsh
binary
prompt
put ${filename}
bye
!
关键字定义文档keyword.conf文件格式：
1 down
2 fail
3 notification
#!/bin/bash
rm /export/home/monitorsh/alertcom.log
#SERVERNAME
SERVERNAME=$(uname -a | awk '{ print $2}')
filename="/export/home/monitorsh/"$SERVERNAME"_DBSERVERLOGMONITOR.sql"
echo "connect user/password" >>${filename}
#要监控的日志，只对变化部分，写入记录，如果需要全文扫描，去掉下面nl和comm行，直接用要扫描的日志文件的绝对路径和文件名替换 alertcom1.log文件，sed行的替换就可以了，注意将文件中的特殊字符转换一下，否则可能出错;首次执行可能因为无历史文件参考而出错，第二 次执行则不会出错
#给日志文件加行标便于比较
nl /export/home/ oracle /admin/orcl/bdump/alert_orcl.log > /export/home/monitorsh/alertnew.log
#比较新日志和上一次统计时的日志，取出差异部分放入 alertcom1.log
comm -23 /export/home/monitorsh/alertnew.log /export/home/monitorsh/alertold.log> /export/home/monitorsh/alertcom1.log
#去掉文件中的特殊字符,图书字符在搜索关键字是可能会导致异常
sed "s/\'/\'\'\'\'/" /export/home/monitorsh/alertcom1.log >/export/home/monitorsh/alertcom.log
linkstring=$(echo "'||chr(13)||chr(10)||'")
while read line
do
keyword=$(echo ${line} | awk '{print $2}')
while read line2
do
#在文档中搜索关键字
keyline=$(echo ${line2} | grep ${keyword} | grep -v grep)
line2num=$(echo ${line2} | awk '{print $1}')
if [ -z "${keyline}" ]
then
echo "OK" >>/export/home/monitorsh/sql/getlog.log
else
LogContent1=$(echo ${line2})
#获得关键字所在行的行标和行内容
LogContent=$line2num"|""""$LogContent1"""
echo "insert into TAB_DBSERVERLOGMONITOR values ("$line2num","$SERVERNAME",'"$keyword"','"$LogContent"','o rac le',to_char(sysdate,'yyyymmddhh24miss'),to_char(sysdate,'yyyymmddhh24miss'));" >>${filename}
echo "commit;" >>${filename}
fi
done < /export/home/monitorsh/alertcom.log
done < /export/home/monitorsh/keyword.conf
rm /export/home/monitorsh/alertold.log
mv /export/home/monitorsh/alertnew.log /export/home/monitorsh/alertold.log
filename=$SERVERNAME"_DBSERVERLOGMONITOR.sql"
ftp -i -n 10.43.94.15 <<!
user user password
cd /export/home/monitorsh/sql
lcd /export/home/monitorsh
binary
prompt
put ${filename}
bye
!
关键字定义文档keyword.conf文件格式：
1 down
2 fail
3 notification
本文转自 vfast_chenxy 51CTO博客，原文链接：http://blog.51cto.com/chenxy/794582，如需转载请自行联系原作者
