salt收集windows服务器日志时间

定义收集时间区间： time.ps1

$day = get-date -format 'dd'
$bday = $day-1
$btime = get-date -format yyyy-M-
$qtime = $btime+$bday

$htime = get-date -format yyyy-M-d
$a = 'T00:00:00'
$b = 'T23:59:00'

$A = $qtime+$a
$B = $htime+$b

get-eventlog -logname system -after $A -before $B | where {$_.eventID -eq 1} | Format-List

使用salt分发time.ps1文件到各Windows sever中：copydir.sls

copy_dir:
  file.managed:
    - name: C:\opstools\time.ps1
    - source: salt://zhouz/time.ps1
    - makedirs: 'True'
  cmd.run:
    - name: powershell.exe C:\opstools\time.ps1

使用脚本收集日志并分析

#!/bin/bash
#

fdir="/tmp/first"
sdir="/tmp/second"
tdir="/tmp/third"
fodir="/tmp/forth"

ColLogs() {
    echo "收集原始系统日志："
    [ -d $fdir ] && rm -rf $fdir && mkdir $fdir || mkdir $fdir
    #weblist=`salt "主机名" test.ping | grep -v "True" | awk -F ':' '{print $1}'`
    #list="`salt "主机名" test.ping | grep -v "True" | awk -F ':' '{print $1}' | xargs echo`"
    list="`salt "主机名" test.ping | grep -v "True" | xargs echo | sed "s/://g"`"
    for i in $list; do
       salt "$i" state.sls zhouz.copydir &> $fdir/$i
       echo "$i is ok"
    done
}

TreatLogsA() {
   echo "整理初始化日志(为对比天、小时、分钟、秒钟等字符串是否一致做准备)："
   [ -d $tdir ] && rm -rf $tdir && mkdir $tdir || mkdir $tdir
   cd $fdir
   for i in $(ls BX*); do
       grep -A 1 ReplacementStrings $i | xargs echo >$tdir/$i
       cd $tdir
       sed -i 's/--/&\n/g' $i
       sed -i 's/--\|{\|}\|[[:space:]]//g' $i
      #sed -i 's/,/ /g' $i
       sed -i 's/,/\./g' $i
       sed -i 's/Z//g' $i
      #sed -i 's/\./:/g' $i
       sed -i 's/ReplacementStrings://g' $i
      #sed -i 's/T/:/g' $i
      #sed -i 's/2019-07-[0-9][0-9]T//g' $i
      #sed -i 's/\.[0-9]\{4,10\}Z//g' $i
       echo "$i is ok"
       cd $fdir
    done
}

TreatLogsB() {
   echo "对收集的初始系统日志进行整理(为对比 毫秒差值 做准备)："
   [ -d $sdir ] && rm -rf $sdir && mkdir $sdir || mkdir $sdir
   cd $fdir
   for i in $(ls BX*); do
       grep -A 1 "ReplacementStrings" $i | xargs echo >$sdir/$i
       cd $sdir
       sed -i 's/--/&\n/g' $i
       sed -i 's/--\|{\|}\|[[:space:]]\|Z//g' $i
       sed -i 's/,/:/g' $i
       sed -i 's/\,\ 1//g' $i
     # sed -i 's/\./:/g' $i  此处将 . 去掉
       sed -i 's/\.//g' $i
       sed -i 's/ReplacementStrings://g' $i
       sed -i 's/T/:/g' $i
     # sed -i 's/2019-07-[0-9][0-9]T//g' $i
       echo "$i is ok"
       cd $fdir
    done
}

TreatLogsC() {
   echo "对收集的初始系统日志进行整理(为对比 秒差值 做准备)："
   [ -d $fodir ] && rm -rf $fodir && mkdir $fodir || mkdir $fodir
   cd $fdir
   for i in $(ls BX*); do
       grep -A 1 ReplacementStrings $i | xargs echo >$fodir/$i
       cd $fodir
       sed -i 's/--/&\n/g' $i
       sed -i 's/--\|{\|}\|[[:space:]]\|Z//g' $i
       sed -i 's/,/:/g' $i
       sed -i 's/\./:/g' $i
      #sed -i 's/\.//g' $i
       sed -i 's/ReplacementStrings://g' $i
       sed -i 's/T/:/g' $i
      #sed -i 's/2019-07-[0-9][0-9]T//g' $i
       echo "$i is ok"
       cd $fdir
    done
}

LogsDay() {
    echo "对比两列数据中秒钟是否一致："
    cd $fodir
    mkdir $fodir/dtime &>/dev/null
    for i in $(ls BX*); do
       #cat $i | awk -F ":" '{print $1,":"$2,":"$3,($4-$9)}' >$fodir/dtime/$i
       cat $i | awk -F ":" '{print ($4-$9)}' >$fodir/dtime/$i
       cd $fodir/dtime
       #count=`grep -E -v "0|1" $i | wc -l`
       count=`grep -E -v "0" $i | wc -l`
       if [ $count -ge 1 ]; then
           echo "$i have problem"
           grep -v '0' $i
       else
           echo "$i is ok"
       fi
       cd $fodir
    done
}

DisTimePeriodA() {
   echo "对比天、小时、分钟、秒钟等字符串是否一致(批量)"
   cd $tdir
   mkdir $tdir/dtime &>/dev/null
   read_file='BX*'
   for file in ${read_file}; do
      echo "$file"
      for ((i=1;i<=$(cat $file| wc -l);i++)); do
         #first="$(sed -n ${i}p $file| awk '{print $1}')"
         first="$(sed -n ${i}p $file| awk -F "." '{print $1}')"
         #second="$(sed -n ${i}p $file | awk '{print $2}')"
         second="$(sed -n ${i}p $file | awk -F "." '{print $3}')"
         #echo "${first}"
         #echo "${second}"
         if [ "${first}" == "${second}" ]; then
            echo "${first} = ${second}" &>/dev/null
         else
            A="$(grep $first $file)"
            #B="$(grep $second $file)"
            #echo "  ${first} != ${second}"
            echo "  ${A}"
         fi
      done
      echo " "
   done
}


DisTimePeriodB() {
   echo "对比天、小时、分钟、秒钟等字符串是否一致(只查询有问题的主机)"
   cd $tdir
   mkdir $tdir/dtime &>/dev/null
   #read_file='BX*'
   #for file in ${read_file}; do

      read -p "请输入有问题的主机名： " file
      echo "$file" >>$tdir/dtime/$file
      for ((i=1;i<=$(cat $file| wc -l);i++)); do
        #first="$(sed -n ${i}p $file| awk '{print $1}')"
         first="$(sed -n ${i}p $file| awk -F "." '{print $1}')"
        #second="$(sed -n ${i}p $file | awk '{print $2}')"
         second="$(sed -n ${i}p $file | awk -F "." '{print $3}')"
         if [ "${first}" == "${second}" ]; then
            echo "${first} = ${second}" &>/dev/null
         else
            #echo "  ${first} != ${second}" >>$tdir/dtime/$file
            A="$(grep $first $file)"
            echo " ${A}"
         fi
      #   echo " " >>$tdir/dtime/$file
      done
   #done
}


LogsMillisecond() {
    echo "对比两列数据中 毫秒 是否一致："
    cd $sdir
    mkdir $sdir/mtime &>/dev/null
    for i in $(ls BX*); do
       cat $i | awk -F ":" '{print $1,":"$2,":"$3,($4-$8)}' | sort -t $' ' -k4 -n >$sdir/mtime/$i
       cd $sdir/mtime
       echo "=================================================="
       echo "$i 两列毫秒为正数的数值最高的10个"
       cat  $i |tail
       #echo "=================================================="
       #echo "$i 两列毫秒为正数的数值最小的10个"
       #cat $i |grep -v '\-[0-9][0-9][0-9][0-9][0-9]' |head -15
       echo "=================================================="
       echo "$i 两列毫秒为负数的数值最大的10个"
       cat $i |grep '\-[0-9][0-9][0-9][0-9]' | head
       #echo "=================================================="
       #echo "$i 两列毫秒为负数的数值最小的10个"
       #cat $i |grep '\-[0-9][0-9][0-9][0-9]' | tail
       cd $sdir
    done
}


#ColLogs
a="ColLogs"
b="TreatLogsA"
c="TreatLogsB"
d="TreatLogsC"
e="LogsDay"
f="DisTimePeriodA"
g="DisTimePeriodB"
h="LogsMillisecond"

echo "请选择你想要执行的功能:
 a: ColLog           收集windows server初始日志;
 b: TreatLogsA       整理初始化日志(为对比天、小时、分钟、秒钟等字符串是否一致做准备);
 c: TreatLogsB       整理初始化日志(为对比  毫秒  差值做准备);
 d: TreatLogsC       整理初始化日志(为对比  秒  差值做准备);
 e: LogsDay          对比两列数据中<< 秒 >>是否一致;
 f: DisTimePeriodA   对比天、小时、分钟、秒钟等字符串是否一致(批量显示);
 g: DisTimePeriodB   对比天、小时、分钟、秒钟等字符串是否一致(只查询有问题的主机);
 h: LogsMillisecond  对比两列数据中<< 毫秒 >>是否一致."

read -n3 -p "请输入：" opt
case $opt in
  a)
    $a ;;
  b)
    $b ;;
  c)
    $c ;;
  d)
    $d ;;
  e)
    $e ;;
  f)
    $f ;;
  g)
    $g ;;
  h)
    $h ;;
  *)
   echo "No opt"
   exit 1
esac

待补充