数据库告警日志出现ORA-3136告警，客户端连接数据库服务认证的时间超时。需要分析监听日志；
WARNING: inbound connection timed out (ORA-3136)

分离IP，匹配IP

grep “HOST=.establish.* 0” listener.log | awk -F’*’ ‘{match($3,/[0-9]+.[0-9]+.[0-9]+.[0-9]+/); print $3,RSTART,RLENGTH}’

输出时间和IP

grep “HOST=.establish.* 0” listener.log | awk -F’*’ ‘{match($3,/[0-9]+.[0-9]+.[0-9]+.[0-9]+/); print $1,substr($3,RSTART,RLENGTH)}’

输出Hour和IP

grep “HOST=.establish.* 0” listener.log | awk -F’*’ ‘{match($3,/[0-9]+.[0-9]+.[0-9]+.[0-9]+/); print substr($1,13,2),substr($3,RSTART,RLENGTH)}’

输出时间，小时，IP

grep “HOST=.establish.* 0” listener.log | awk -F’*’ ‘{match($3,/[0-9]+.[0-9]+.[0-9]+.[0-9]+/); print $1,substr($1,26,2),substr($3,RSTART,RLENGTH)}’

输出2020年5月26号的Hour，IP

grep "26-MAY-2020.HOST=.establish.* 0" listener.log | awk -F’’ ‘{match($3,/[0-9]+.[0-9]+.[0-9]+.[0-9]+/); print substr($1,13,2),substr($3,RSTART,RLENGTH)}’

把IP和Hour关联

grep “26-MAY-2020.HOST=.establish.* 0" listener.log | awk -F’’ '{match($3,/[0-9]+.[0-9]+.[0-9]+.[0-9]+/); ip=substr($1,13,2)”-"substr($3,RSTART,RLENGTH);print ip}’

统计IP,Hour的次数，并排序

grep “26-MAY-2020.HOST=.establish.* 0" listener.log | awk -F’’ '{match($3,/[0-9]+.[0-9]+.[0-9]+.[0-9]+/); ip=substr($1,13,2)”-"substr($3,RSTART,RLENGTH);cnt[ip]+=1;last[ip]=$1;}END {for (i in cnt) printf “%-16s %9s \n”,i,cnt[i];}’ | sort -n -t " " -k 2

-n 按数值排序

-t 指定列分隔

-k 按第2列排序

grep “HOST=.establish.* 0” listener.log | awk -F’*’ ‘{match($3,/[0-9]+.[0-9]+.[0-9]+.[0-9]+/); ip = substr($3,RSTART,RLENGTH);cnt[ip]+=1;last[ip]=$1;}END {for (i in cnt) printf “%-16s %9s %19s\n”,i,cnt[i],last[i];}’ | sort -k 1