<\/span><\/h3>\n\n\n\n\u5b57\u6bb5\u540d\u53ef\u6839\u636e\u60c5\u51b5\uff0c\u505a\u4fee\u6539\uff0c\u6ce8\u610f\u5176\u4e2d\u7684Query_time ,\u662fdecimal\u5c0f\u6570\u7c7b\u578b<\/p>\n\n\n\n
\u8868\u540d\u5b57\u53ef\u4ee5\u968f\u610f\u4fee\u6539\uff0c\u540e\u9762\u52a0\u8f7d\u7684\u8868\u540d\u6ce8\u610f\u5bf9\u5e94\u4e0a\u5c31\u884c\u3002<\/p>\n\n\n\n
create table al(\nThreadid bigint,\nTaskid bigint,\nTime datetime,\nEnd_time datetime,\nUser_Host varchar(1000),\nUID bigint,\nQuery_time decimal(16,6),\nRows bigint,\nTables_list varchar(8000),\nSql_text varchar(8000),\nSql_command varchar(100),\nSql_type varchar(100),\nStatus varchar(100),\nconn_type varchar(100)\n);<\/code><\/pre>\n\n\n\n<\/span>\u52a0\u8f7dSQL<\/span><\/h3>\n\n\n\nload data infile 'sftp:\/\/gbase:gbase1234@10.0.2.201\/home\/gbase\/zxq\/audit_log\/al.log' into table al fields terminated by '^GBASE^' TABLE_FIELDS 'Threadid,Taskid,Time,End_time,User_Host,UID,Query_time,Rows,Tables_list,Sql_text,Sql_command,sql_type,Status,conn_type' lines terminated by '^GBASE_GBASE^' DATETIME FORMAT '%y%m%d %H:%i:%s';s\nQuery OK, 7 rows affected (Elapsed: 00:00:01.72)<\/code><\/pre>\n\n\n\n<\/span>\u5b8c\u6574\u811a\u672c<\/span><\/h3>\n\n\n\n\u6ce8\u610f\u91cc\u9762infile\u6570\u636e\u6e90\u7684\u90e8\u5206\uff0cIP,\u64cd\u4f5c\u7cfb\u7edf\u7528\u6237\u540d\u548c\u5bc6\u7801\uff0c\u8def\u5f84\u7b49\uff0c\u9700\u8981\u6839\u636e\u5b9e\u9645\u60c5\u51b5\u4fee\u6539\u811a\u672c\u3002<\/p>\n\n\n\n
[gbase@rh6-1 audit_log]$ cat auditlog_load.sh\nlogfile=$1\nusername=$2\npassword=$3\ndbname=$4\ntablename=$5\n\ncat $logfile |sed 's\/# Threadid=\\([0-9]\\+\\);\/\\1\/g' |sed 's\/# Taskid=\\([0-9]\\+\\);\/^GBASE^\\1\/g' |sed 's\/# Time: \\(.\\+\\)\/^GBASE^\\1\/g' |sed 's\/# End_time: \\(.\\+\\)\/^GBASE^\\1\/g' |sed 's\/# User@Host: \\(.*\\)\/^GBASE^\\1\/g' |sed 's\/# UID: \\([0-9]\\+\\)\/^GBASE^\\1\/g' |sed 's\/# Query_time: \\(.*\\) Rows: \\([0-9]\\+\\)\/^GBASE^\\1\\n^GBASE^\\2\/g' |sed 's\/# Tables: \\(.*\\);\/^GBASE^\\1\/g' |sed 's\/# SET timestamp=\\([0-9]*\\);\/\/g' |sed 's\/# # administrator command: \\([0-9]*\\);\/\/g' |sed 's\/# Sql_text:\\(.*\\)\/^GBASE^\\1\/g' |sed 's\/# Sql_type:\\(.*\\);\/^GBASE^\\1\/g' |sed 's\/# Sql_command: \\(.*\\)\/^GBASE^\\1\/g' |sed 's\/# Status: \\(.*\\)\/^GBASE^\\1\/g' |sed 's\/# Connect Type: \\(.*\\);\/^GBASE^\\1^GBASE_GBASE^\/g' > tmp_auditlog_load.log\n\ngccli -vvv -u${username} -p${password} -e\"load data infile 'sftp:\/\/gbase:gbase1234@10.0.2.201\/home\/gbase\/zxq\/audit_log\/tmp_auditlog_load.log' into table ${dbname}.${tablename} fields terminated by '^GBASE^' TABLE_FIELDS 'Threadid,Taskid,Time,End_time,User_Host,UID,Query_time,Rows,Tables_list,Sql_text,Sql_command,sql_type,Status,conn_type' lines terminated by '^GBASE_GBASE^' DATETIME FORMAT '%y%m%d %H:%i:%s'\"\n<\/code><\/pre>\n\n\n\n<\/span>\u8fd0\u884c\u6837\u4f8b<\/span><\/h3>\n\n\n\n[gbase@rh6-1 audit_log]$ sh auditlog_load.sh gclusterd-audit.log gbase gbase20110531 al al\n--------------\nload data infile 'sftp:\/\/gbase:gbase1234@10.0.2.201\/home\/gbase\/zxq\/audit_log\/tmp_auditlog_load.log' into table al.al fields terminated by '^GBASE^' TABLE_FIELDS 'Threadid,Taskid,Time,End_time,User_Host,UID,Query_time,Rows,Tables_list,Sql_text,Sql_command,sql_type,Status,conn_type' lines terminated by '^GBASE_GBASE^' DATETIME FORMAT '%y%m%d %H:%i:%s'\n--------------\n\nQuery OK, 7 rows affected (Elapsed: 00:00:01.73)\nTask 73 finished, Loaded 7 records, Skipped 28 records\n\nBye\n<\/code><\/pre>\n\n\n\n<\/span>\u6ce8\u610f\u4e8b\u9879\u548c\u9650\u5236<\/span><\/h3>\n\n\n\n\u6240\u6709\u4ece\u5ba2\u6237\u7aef\u53d1\u6765\u7684SQL,\u90fd\u80fd\u88ab\u52a0\u8f7d\uff0c\u800c\u6570\u636e\u5e93\u5185\u90e8\u4e92\u76f8\u53d1\u7684SQL, \u4ece\u539f\u59cb\u6570\u636e\u770b\uff0c\u6ca1\u6709TIME\u5b57\u6bb5\uff0c\u53ea\u6709END_TIME
\u6bd4\u5982<\/p>\n\n\n\n
# Threadid=52;\n# Taskid=0;\n# End_time: 211025 13:00:01\n# User@Host: root[root] @ [10.0.2.201]\n# UID: 1\n# Query_time: 0.000228 Rows: 0\n# SET timestamp=1635138001;\n# administrator command: Quit;\n# Sql_type: OTHERS;\n# Sql_command: Quit;\n# Status: SUCCESS;\n# Connect Type: CAPI;<\/code><\/pre>\n\n\n\n\u5982\u679c\u60f3\u8fd9\u7c7b\u5185\u90e8SQL\u4e5f\u52a0\u8f7d\uff0c\u53ea\u80fd<\/p>\n\n\n\n
1\u3001\u727a\u7272\u6389\u5176\u5b83SQL\u7684TIME\u5b57\u6bb5\uff0csed\u65f6\u66ff\u6362\u6210\u7a7a
2\u3001\u52062\u6b21\u52a0\u8f7d\uff0c\u7b2c\u4e00\u6b21\u5e26TIME\u5b57\u6bb5\uff0c\u5176\u5b83\u7684\u4e3a\u9519\u8bef\u6570\u636e\uff0c\u7b2c\u4e8c\u6b21\u4e0d\u5e26TIME\u5b57\u6bb5\u3002
3\u3001\u5176\u5b83\u7684\u6ca1\u52a0\u8f7d\u6210\u529f\u7684\uff0c\u5c31\u7b97\u4e86\u5427<\/p>\n\n\n\n
gbase> load data infile 'sftp:\/\/gbase:gbase1234@10.0.2.201\/home\/gbase\/zxq\/audit_log\/al.log' into table al fields terminated by '$GBASE$' TABLE_FIELDS 'Threadid,Taskid,Time,End_time,User_Host,UID,Query_time,Rows,Tables_list,Sql_text,Sql_command,sql_type,Status,conn_type' lines terminated by '$GBASE_GBASE$' DATETIME FORMAT '%y%m%d %H:%i:%s';\nQuery OK, 7 rows affected (Elapsed: 00:00:01.62)\nTask 74 finished, Loaded 7 records, Skipped 28 records\n\ngbase> load data infile 'sftp:\/\/gbase:gbase1234@10.0.2.201\/home\/gbase\/zxq\/audit_log\/al.log' into table al fields terminated by '$GBASE$' TABLE_FIELDS 'Threadid,Taskid,End_time,User_Host,UID,Query_time,Rows,Tables_list,Sql_text,Sql_command,sql_type,Status,conn_type' lines terminated by '$GBASE_GBASE$' DATETIME FORMAT '%y%m%d %H:%i:%s';\nQuery OK, 18 rows affected (Elapsed: 00:00:01.39)\nTask 75 finished, Loaded 18 records, Skipped 17 records\n<\/code><\/pre>\n\n\n\n<\/span>Python\u5904\u7406\u65b9\u6848(\u5efa\u8bae)<\/span><\/h2>\n\n\n\n<\/span>\u811a\u672c<\/span><\/h3>\n\n\n\n\u5176\u4e2d\u65e5\u5fd7\u6587\u4ef6\u540d\u5199\u6b7b\u4e86\uff0c\u8bf7\u81ea\u884c\u4fee\u6539\u3002 \u539f\u7406\u5c31\u662f\u6309\u7167\\n# Threadid=\u5206\u5272\u6210\u591a\u6761\u8bb0\u5f55\uff0c\u7136\u540e\u5728\u4e00\u4e2a\u8bb0\u5f55\u5185\uff0c\u518d\u5206\u5272\uff0c\u5e76\u9010\u4e2a\u5b57\u6bb5\u7684\u626b\u63cf\u5339\u914d\u3002 \u7ee7\u7eed\u7528\u81ea\u5b9a\u4e49\u5206\u9694\u7b26\u505a\u5b57\u6bb5\u548c\u884c\u5206\u9694\u7b26\u3002<\/p>\n\n\n\n
\u6ce8\u610f\uff0c\u76f8\u6bd4shell\u811a\u672c\u7684\u7248\u672c\uff0c<\/p>\n\n\n\n
- \u5bf9\u65e5\u671f\u5b57\u6bb5\u5df2\u7ecf\u505a\u4e86\u683c\u5f0f\u5316\u5904\u7406<\/li>
- \u5f00\u59cb\u65f6\u95f4\u4f1a\u9009\u62e9time\u5b57\u6bb5\u548ctimestamp\u5b57\u6bb5\u4e2d\u7684\u4e00\u4e2a<\/li>
- \u5206\u5272\u7b26\u4e2d\uff0c\u786e\u5b9e\u53d1\u73b0\u4e86\u90e8\u5206\u6570\u636e\u7531\u4e8e\\x00, \u5185\u90e8\u505a\u4e86replace\u5904\u7406<\/li><\/ul>\n\n\n\n
[root@rh6-1 gbase]# cat auditlog.py\r\nfrom datetime import datetime\r\n\r\nfo = open('gclusterd-audit.log')\r\nstr = fo.read()\r\nx=str.split('\\n# Threadid=')\r\nnum=0\r\nfor part in x:\r\n num = num + 1\r\n ps=part.replace('\\n\\x00#','\\n#').split('\\n# ')\r\n threadid=ps[0].strip(';')\r\n taskid=0\r\n starttime=''\r\n timestamp=''\r\n endtime=''\r\n user=''\r\n host=''\r\n uid=0\r\n querytime=0\r\n rows=0\r\n sqltext=''\r\n status=''\r\n sqltype=''\r\n sqlcommand=''\r\n contype=''\r\n for index in range(1,len(ps)):\r\n if ps[index].startswith('Taskid='):\r\n taskid=ps[index].split('=')[1].strip(';')\r\n elif ps[index].startswith('Time: '):\r\n starttime=datetime.strptime(ps[index].split(':',1)[1].strip(),'%y%m%d %H:%M:%S')\r\n elif ps[index].startswith('SET timestamp='):\r\n timestamp=datetime.fromtimestamp(int(ps[index].split('=')[1].strip(';')))\r\n elif ps[index].startswith('End_time:'):\r\n endtime=datetime.strptime(ps[index].split(':',1)[1].strip(),'%y%m%d %H:%M:%S')\r\n elif ps[index].startswith('User@Host'):\r\n userhost=ps[index].split(': ',1)[1].strip().split('@')\r\n user=userhost[0].strip()\r\n host=userhost[1].strip()\r\n elif ps[index].startswith('UID:'):\r\n uid=ps[index].split(': ',1)[1].strip()\r\n elif ps[index].startswith('Query_time'):\r\n qt=ps[index].split(': ',1)[1].split('Rows:')\r\n querytime=qt[0].strip()\r\n rows=qt[1].strip()\r\n elif ps[index].startswith('Sql_text:'):\r\n sqltext=ps[index].split(': ',1)[1].strip(';')\r\n elif ps[index].startswith('Status:'):\r\n status=ps[index].split(': ',1)[1].strip(';')\r\n elif ps[index].startswith('Sql_type:'):\r\n sqltype=ps[index].split(': ',1)[1].strip(';')\r\n elif ps[index].startswith('Sql_command:'):\r\n sqlcommand=ps[index].split(': ',1)[1].strip(';')\r\n elif ps[index].startswith('Connect Type:'):\r\n contype=ps[index].split(': ',1)[1].strip(';\\n')\r\n# print(\"\\n------------------------%s------\\nthreadid=%s,taskid=%s,starttime=%s,timestamp=%s,userhost=%s,uid=%s,querytime=%s,rows=%s,sqltext=%s,status=%s,sqltype=%s,sqlcommand=%s,contype=%s#\" %(num,threadid,taskid,starttime,timestamp,userhost,uid,querytime,rows,sqltext,status,sqltype,sqlcommand,contype))\r\n if starttime=='':\r\n starttime=timestamp\r\n print('%s^GBASE^%s^GBASE^%s^GBASE^%s^GBASE^%s^GBASE^%s^GBASE^%s^GBASE^%s^GBASE^%s^GBASE^%s^GBASE^%s^GBASE^%s^GBASE^%s^GBASE^%s^GBASE_GBASE^' %(threadid,taskid,starttime,endtime,user,host,uid,querytime,rows,sqltext,status,sqltype,sqlcommand,contype))\r\n\r\nfo.close()\r\n<\/code><\/pre>\n\n\n\n<\/span>\u5efa\u8868\u8bed\u53e5<\/span><\/h3>\n\n\n\ncreate table auditlog_load(\r\nthread_id bigint,\r\ntaskid bigint,\r\nstart_time datetime,\r\nend_time datetime,\r\nuser varchar(200),\r\nhost varchar(200),\r\nuid bigint,\r\nquerytime decimal(16,6),\r\nrows bigint,\r\nsql_text text,\r\nstatus varchar(20) ,\r\nsql_type varchar(20),\r\nsql_command text,\r\nconn_type varchar(100)\r\n);\r\n<\/code><\/pre>\n\n\n\n<\/span>\u52a0\u8f7d\u65b9\u5f0f<\/span><\/h3>\n\n\n\nload data infile 'sftp:\/\/gbase:gbase1234@10.0.2.201\/home\/gbase\/audit_toload.txt' into table auditlog_load fields terminated by '^GBASE^' lines terminated by '^GBASE_GBASE^\\n' DATETIME FORMAT '%Y-%m-%d %H:%i:%s';\r\n<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"\u672c\u6587\u4ecb\u7ecd\u4e00\u79cd\uff0c\u4ece\u6587\u672c\u683c\u5f0f\u7684\u5ba1\u8ba1\u65e5\u5fd7\uff0c\u901a\u8fc7\u66ff\u6362\u81ea\u5b9a\u4e49\u5b57\u6bb5\u548c\u884c\u5206\u9694\u7b26\uff0c\u52a0\u8f7d\u5230GBase 8a\u6570\u636e\u5e93\u7684\u65b9\u6cd5\u3002<\/p>","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[10],"class_list":["post-8272","post","type-post","status-publish","format-standard","hentry","category-gbase8a","tag-10"],"_links":{"self":[{"href":"https:\/\/www.gbase8.cn\/en\/wp-json\/wp\/v2\/posts\/8272","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.gbase8.cn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.gbase8.cn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.gbase8.cn\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.gbase8.cn\/en\/wp-json\/wp\/v2\/comments?post=8272"}],"version-history":[{"count":10,"href":"https:\/\/www.gbase8.cn\/en\/wp-json\/wp\/v2\/posts\/8272\/revisions"}],"predecessor-version":[{"id":8621,"href":"https:\/\/www.gbase8.cn\/en\/wp-json\/wp\/v2\/posts\/8272\/revisions\/8621"}],"wp:attachment":[{"href":"https:\/\/www.gbase8.cn\/en\/wp-json\/wp\/v2\/media?parent=8272"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.gbase8.cn\/en\/wp-json\/wp\/v2\/categories?post=8272"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.gbase8.cn\/en\/wp-json\/wp\/v2\/tags?post=8272"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}