一、netstat分析
1、完整命令
netstat -n | awk -F ':' '{print $2}'|awk -F ' ' '{print $1}'|grep -v '^\s*$'|sort|uniq -c|sort -r|more
最终返回每个端口未关闭的TCP连接的数量，可见，8099端口（hubble-sdk-api）最多，其次是8081端口（hubble-api）
2、命令简单说明
第一步：打印数据，查看格式
netstat -n：列出所有基于ip和端口的TCP连接列表
如下所示：
Local Address：表示本机打开的端口，可能是监听端口（即本地为服务进程，开启的端口）
Foreign Address：和外部哪个ip哪个端口建立的连接。
如果Local Address为本地启动服务监听端口，则Foreign Address为客户端
如果Foreign Addres为服务端监听的地址端口，则Local Address为本地打开的一个端口，为了和服务端建立TCP连接
第二步：分析数据
命令：awk -F ':' '{print $2}'|awk -F ' ' '{print $1}'：是经过了两次分析
第一次通过“:”分隔，获取第二块包含端口的内容（因为主要是分析端口的数量）
第二次是再次对输入流进行分隔，这次需要按照空格分隔，取第一个得到端口
第三步：过滤
命令：grep -v '^\s*$'
由于可能存在一些空格啥的乱七八糟的东西，因此需要过滤掉
第四步：计算
命令：sort|uniq -c|sort -r
首先通过sort进行排序，然后用uniq -c去重，并计算重复端口的数量，最后再根据重复端口的数量进行下排序
二、文件分析
sort -k11rg hubble_api_access_log.2019-09-05.txt |grep '/api/alarm/findAlarmByPage'
背景：今天想查下有哪些ip调用了updateZabbixAgent（此接口即禁用接口）接口。日志在info.log中，因此要操作这个文件。
updateZabbixAgent||updateZabbixAgent ip=
updateZabbixAgent||agentName=
以上两行为调用接口会打印的日志。
根据以上日志信息可知，要分析出具体的哪些ip调用了这个接口，调用了多少次，并按照调用次数作降序排列。怎么做到呢？
首先查出日志中包含上面日志的，如updateZabbixAgent||agentName=，如下所示：
cat info.log|grep 'updateZabbixAgent||updateZabbixAgent ip='这样查出来的内容如下所示：
2016-03-10 14:31:48||ApiServiceImpl.java||updateZabbixAgent||agentName=beijing2-21vianet-10-77-33-5.idc.qiyi.domain
2016-03-10 14:31:49||ApiServiceImpl.java||updateZabbixAgent||agentName=beijing2-21vianet-10-77-33-5.idc.qiyi.domain
2016-03-10 14:31:58||ApiServiceImpl.java||updateZabbixAgent||agentName=hangzhou5-wasu-113-215-7-199.idc.qiyi.domain
2016-03-10 14:31:58||ApiServiceImpl.java||updateZabbixAgent||agentName=hangzhou5-wasu-113-215-7-199.idc.qiyi.domain
2016-03-10 14:31:58||ApiServiceImpl.java||updateZabbixAgent||agentName=qlbmonitor-internal-master-online001-bjlt.qiyi.virtual
2016-03-10 14:31:59||ApiServiceImpl.java||updateZabbixAgent||agentName=qlbmonitor-internal-master-online001-bjlt.qiyi.virtual这样还是不够，因为我知道这里面肯定有很多重复的。我想知道每个agentname调用了多少次。
但是在这之前必须对上面的信息进行处理，把agentname抽取出来。我们以等号“=”分割就可以分开了。
等号分开后产生两个参数，
分别是：$1=2016-03-10 00:00:07||ApiServiceImpl.java||updateZabbixAgent||agentName=
$2=guangzhou-gwbn-211-162-56-69.idc.qiyi.domain
然后我们取第二个参数即可。分割命令：awk -F '='
分割之后调用命令：打印第二个参数，即awk -F '=' '{print $2}'，因此命令就变成了：
cat info.log|grep 'updateZabbixAgent||agentName=' | awk -F '=' '{print $2}'
打印结果就是所有主机名，如下：
shijiazhuang5-cnc-10-31-28-32.idc.qiyi.domain
nanchang-cmnet-223-82-244-5.idc.qiyi.domain
nanchang-cmnet-223-82-244-5.idc.qiyi.domain
hangzhou5-wasu-113-215-7-203.idc.qiyi.domain
hangzhou5-wasu-113-215-7-203.idc.qiyi.domain
beijing2-21vianet-10-77-33-7.idc.qiyi.domain
beijing2-21vianet-10-77-33-7.idc.qiyi.domain
vcache-g615bx1-dongguan3_ct.qiyi.domain
vcache-g615bx1-dongguan3_ct.qiyi.domain
qlbmonitor-internal-master-online001-bjdxt6.qiyi.virtual
qlbmonitor-internal-master-online001-bjdxt6.qiyi.virtual
jiyang-cnc-10-153-89-34.idc.qiyi.domain
jiyang-cnc-10-153-89-34.idc.qiyi.domain
beijing2-21vianet-10-77-33-1.idc.qiyi.domain
beijing2-21vianet-10-77-33-1.idc.qiyi.domain
shan3xi-scc-139-148-1-165.idc.qiyi.domain
vcache-6hwdc3x-jinan_cmnet.qiyi.domain
shan3xi-scc-139-148-1-165.idc.qiyi.domain
vcache-6hwdc3x-jinan_cmnet.qiyi.domain
beijing2-21vianet-10-77-33-7.idc.qiyi.domain
beijing2-21vianet-10-77-33-7.idc.qiyi.domain
beijing2-21vianet-10-77-33-8.idc.qiyi.domain
beijing2-21vianet-10-77-33-8.idc.qiyi.domain
beijing2-21vianet-10-77-33-1.idc.qiyi.domain
beijing2-21vianet-10-77-33-1.idc.qiyi.domain
beijing4-21vianet-10-77-48-39.idc.qiyi.domain
beijing4-21vianet-10-77-48-39.idc.qiyi.domain
beijing2-21vianet-10-77-33-8.idc.qiyi.domain
beijing2-21vianet-10-77-33-8.idc.qiyi.domain
beijing2-21vianet-10-77-33-15.idc.qiyi.domain
beijing2-21vianet-10-77-33-15.idc.qiyi.domain
guangzhou-scc-103-27-27-50.idc.qiyi.domain
guangzhou-scc-103-27-27-50.idc.qiyi.domain
hunan-citic-122-48-244-154.idc.qiyi.domain
hunan-citic-122-48-244-154.idc.qiyi.domain
shan3xi-scc-139-148-1-162.idc.qiyi.domain
shan3xi-scc-139-148-1-162.idc.qiyi.domain
vcache-h612bx1-dongguan3_ct.qiyi.domain
vcache-h612bx1-dongguan3_ct.qiyi.domain
beijing2-21vianet-10-77-33-15.idc.qiyi.domain
beijing2-21vianet-10-77-33-10.idc.qiyi.domain
beijing2-21vianet-10-77-33-15.idc.qiyi.domain
beijing2-21vianet-10-77-33-10.idc.qiyi.domain
dalian-fbwn-49-5-7-4.idc.qiyi.domain
dalian-fbwn-49-5-7-4.idc.qiyi.domain
beijing2-21vianet-10-77-33-10.idc.qiyi.domain
beijing2-21vianet-10-77-33-10.idc.qiyi.domain
jiyang-cnc-10-153-89-32.idc.qiyi.domain
jiyang-cnc-10-153-89-32.idc.qiyi.domain
guangzhou-scc-103-27-27-52.idc.qiyi.domain
guangzhou-scc-103-27-27-52.idc.qiyi.domain
beijing4-ct-10-10-130-59.idc.qiyi.domain
beijing4-ct-10-10-130-59.idc.qiyi.domain
nanning-gwbn-211-162-50-37.idc.qiyi.domain
nanning-gwbn-211-162-50-37.idc.qiyi.domain
vcache-baode01-zhujiang_catv.qiyi.domain
vcache-baode01-zhujiang_catv.qiyi.domain
zhejiang5-cmnet-10-57-170-103.idc.qiyi.domain
zhejiang5-cmnet-10-57-170-103.idc.qiyi.domain
jinan-cmnet-120-192-83-10.idc.qiyi.domain
jinan-cmnet-120-192-83-10.idc.qiyi.domain
vcache-6gwdc3x-jinan_cmnet.qiyi.domain
vcache-6gwdc3x-jinan_cmnet.qiyi.domain
guangzhou-scc-103-27-27-42.idc.qiyi.domain
guangzhou-scc-103-27-27-42.idc.qiyi.domain然后就要进行统计分析了。每个主机名调用了多少次，则要用到sort和uniq -c命令。
sort将文件的每一行作为一个单位，相互比较，比较原则是从首字符向后，依次按ASCII码值进行比较，最后将他们按升序输出。
uniq -c是比较相邻两行是否一样，一样就加一，既然比较相邻两行，那必须先排序，把一样的放在一起，然后统计次数。所以命令如下：
cat info.log|grep 'updateZabbixAgent||agentName=' | awk -F '=' '{print $2}'|sort|uniq -C打印如下：
120 shanghai6-ct-10-121-33-43.idc.qiyi.domain
78 shanghai6-ct-10-121-64-183.idc.qiyi.domain
120 shanghai-gwbn-124-14-11-81.idc.qiyi.domain
120 shanghai-gwbn-124-14-11-82.idc.qiyi.domain
120 shanghai-gwbn-124-14-11-83.idc.qiyi.domain
120 shanghai-gwbn-124-14-11-84.idc.qiyi.domain
120 shanghai-gwbn-124-14-11-85.idc.qiyi.domain
120 shanghai-gwbn-124-14-11-86.idc.qiyi.domain
120 shijiazhuang5-cnc-10-31-28-10.idc.qiyi.domain
118 shijiazhuang5-cnc-10-31-28-11.idc.qiyi.domain
118 shijiazhuang5-cnc-10-31-28-12.idc.qiyi.domain
118 shijiazhuang5-cnc-10-31-28-13.idc.qiyi.domain
118 shijiazhuang5-cnc-10-31-28-1.idc.qiyi.domain
118 shijiazhuang5-cnc-10-31-28-32.idc.qiyi.domain
2 shijiazhuang5-cnc-10-31-28-40.idc.qiyi.domain
118 shijiazhuang5-cnc-10-31-28-47.idc.qiyi.domain
2 shijiazhuang5-cnc-10-31-28-57.idc.qiyi.domain
6 shijiazhuang-cnc-10-31-50-97.idc.qiyi.domain
118 suzhou-gwbn-101-247-66-198.idc.qiyi.domain
2 vcache-1912bx1-chongqing3_cnc.qiyi.domain
4 vcache-1sn373x-wuhan_aipu.qiyi.domain
4 vcache-2bqbg02-wuhan_aipu.qiyi.domain
4 vcache-4twbg02-wuhan_aipu.qiyi.domain
4 vcache-5twbg02-wuhan_aipu.qiyi.domain
118 vcache-6gwdc3x-jinan_cmnet.qiyi.domain
118 vcache-6hwdc3x-jinan_cmnet.qiyi.domain
4 vcache-7twbg02-wuhan_aipu.qiyi.domain
4 vcache-8twbg02-wuhan_aipu.qiyi.domain
118 vcache-9gwdc3x-jinan_cmnet.qiyi.domain
118 vcache-baode01-zhujiang_catv.qiyi.domain
118 vcache-bpxbg02-jinan2_cmnet.qiyi.domain
116 vcache-ccpbg02-jinan2_cmnet.qiyi.domain
6 vcache-cm6t13x-wuhan_aipu.qiyi.domain
118 vcache-dpxbg02-jinan2_cmnet.qiyi.domain
4 vcache-dsw333x-wuhan_aipu.qiyi.domain
4 vcache-fsw333x-wuhan_aipu.qiyi.domain
118 vcache-g615bx1-dongguan3_ct.qiyi.domain
4 vcache-gz7vky1-gansu_cmnet.qiyi.domain
120 vcache-h612bx1-dongguan3_ct.qiyi.domain
6 vcache-hq1hf3x-jinan_cmnet.qiyi.domain
6 vcache-j08vky1-gansu_cmnet.qiyi.domain
118 vcache-j613bx1-dongguan3_ct.qiyi.domain
2 vip-api-web-online004-jylt.qiyi.virtual
2 vipapi-web-online004-shjj.qiyi.virtual
2 vipapi-web-online005-bjlt.qiyi.virtual
2 vipapi-web-online010-bjlt.qiyi.virtual
2 vipapi-web-online013-jyyd.qiyi.virtual
2 vipapi-web-online014-jyyd.qiyi.virtual
2 vipapi-web-online015-jyyd.qiyi.virtual
6 vip-web-online010-bjdx.qiyi.virtual
2 vip-web-online011-bjdx.qiyi.virtual
4 wuhan-aipu-183-95-132-175.idc.qiyi.domain
2 xiaomi-vipapi-web-online002-bjdx.qiyi.virtual
2 xiaomi-vipapi-web-online003-bjdx.qiyi.virtual
2 zhanjiang6-ct-10-20-187-145.idc.qiyi.domain
118 zhejiang5-cmnet-10-57-170-100.idc.qiyi.domain
118 zhejiang5-cmnet-10-57-170-101.idc.qiyi.domain
118 zhejiang5-cmnet-10-57-170-102.idc.qiyi.domain
118 zhejiang5-cmnet-10-57-170-103.idc.qiyi.domain
118 zhejiang5-cmnet-10-57-170-104.idc.qiyi.domain
118 zhejiang5-cmnet-10-57-170-105.idc.qiyi.domain
118 zhejiang5-cmnet-10-57-170-106.idc.qiyi.domain
120 zhejiang5-cmnet-10-57-170-107.idc.qiyi.domain
118 zhejiang5-cmnet-10-57-170-108.idc.qiyi.domain
118 zhejiang5-cmnet-10-57-170-109.idc.qiyi.domain
118 zhengzhou4-cnc-10-37-60-172.idc.qiyi.domain前面就得到调用次数了。
最后再来一次按照次数排列就行了。加上sort -n 即按照数字进行排序。命令如下：
cat info.log|grep 'updateZabbixAgent||agentName=' | awk -F '=' '{print $2}'|sort|uniq -c|sort -n查询结果：前面是调用次数。
118 guangzhou-scc-103-27-27-52.idc.qiyi.domain
118 hangzhou5-wasu-113-215-7-199.idc.qiyi.domain
118 hangzhou5-wasu-113-215-7-201.idc.qiyi.domain
118 hangzhou5-wasu-113-215-7-203.idc.qiyi.domain
118 hunan-citic-122-48-244-154.idc.qiyi.domain
118 jinan2-cnc-10-53-20-80.idc.qiyi.domain
118 jiyang-cnc-10-153-89-31.idc.qiyi.domain
118 jiyang-cnc-10-153-89-32.idc.qiyi.domain
118 jiyang-cnc-10-153-89-33.idc.qiyi.domain
118 jiyang-cnc-10-153-89-35.idc.qiyi.domain
118 jiyang-cnc-10-153-89-36.idc.qiyi.domain
118 jiyang-cnc-10-153-89-38.idc.qiyi.domain
118 live-show-server-web-online011-sjhl.qiyi.virtual
118 nanchang-cmnet-223-82-244-13.idc.qiyi.domain
118 nanchang-cmnet-223-82-244-5.idc.qiyi.domain
118 nanning-cmnet-122-72-96-173.idc.qiyi.domain
118 nanning-gwbn-211-162-50-40.idc.qiyi.domain
118 nanning-gwbn-211-162-50-46.idc.qiyi.domain
118 qlbmonitor-internal-master-online001-bjdx.qiyi.virtual
118 qlbmonitor-internal-master-online001-bjdxt6.qiyi.virtual
118 qlbmonitor-internal-master-online001-jylt.qiyi.virtual
118 qlbmonitor-internal-master-online001-sjhl.qiyi.virtual
118 scache-537h032-taibei_other.qiyi.domain
118 shan3xi-scc-139-148-1-162.idc.qiyi.domain
118 shan3xi-scc-139-148-1-164.idc.qiyi.domain
118 shan3xi-scc-139-148-1-165.idc.qiyi.domain
118 shanghai12-ct-10-221-32-16.idc.qiyi.domain
118 shijiazhuang5-cnc-10-31-28-11.idc.qiyi.domain
118 shijiazhuang5-cnc-10-31-28-12.idc.qiyi.domain
118 shijiazhuang5-cnc-10-31-28-13.idc.qiyi.domain
118 shijiazhuang5-cnc-10-31-28-1.idc.qiyi.domain
118 shijiazhuang5-cnc-10-31-28-32.idc.qiyi.domain
118 shijiazhuang5-cnc-10-31-28-47.idc.qiyi.domain
118 vcache-6gwdc3x-jinan_cmnet.qiyi.domain
118 vcache-6hwdc3x-jinan_cmnet.qiyi.domain
118 vcache-9gwdc3x-jinan_cmnet.qiyi.domain
118 vcache-baode01-zhujiang_catv.qiyi.domain
118 vcache-bpxbg02-jinan2_cmnet.qiyi.domain
118 vcache-dpxbg02-jinan2_cmnet.qiyi.domain
118 vcache-g615bx1-dongguan3_ct.qiyi.domain
118 zhejiang5-cmnet-10-57-170-100.idc.qiyi.domain
118 zhejiang5-cmnet-10-57-170-101.idc.qiyi.domain
118 zhejiang5-cmnet-10-57-170-102.idc.qiyi.domain
118 zhejiang5-cmnet-10-57-170-103.idc.qiyi.domain
118 zhejiang5-cmnet-10-57-170-104.idc.qiyi.domain
118 zhejiang5-cmnet-10-57-170-105.idc.qiyi.domain
118 zhejiang5-cmnet-10-57-170-108.idc.qiyi.domain
118 zhejiang5-cmnet-10-57-170-109.idc.qiyi.domain
118 zhengzhou4-cnc-10-37-60-172.idc.qiyi.domain
119 beijing4-ct-10-10-130-59.idc.qiyi.domain
120 beijing2-21vianet-10-77-32-72.idc.qiyi.domain
120 beijing2-21vianet-10-77-33-10.idc.qiyi.domain
120 beijing2-21vianet-10-77-33-11.idc.qiyi.domain
120 beijing2-21vianet-10-77-33-12.idc.qiyi.domain
120 beijing2-21vianet-10-77-33-13.idc.qiyi.domain
120 beijing2-21vianet-10-77-33-14.idc.qiyi.domain
120 beijing2-21vianet-10-77-33-15.idc.qiyi.domain
120 beijing2-21vianet-10-77-33-1.idc.qiyi.domain
120 beijing2-21vianet-10-77-33-3.idc.qiyi.domain
120 beijing2-21vianet-10-77-33-4.idc.qiyi.domain
120 beijing2-21vianet-10-77-33-5.idc.qiyi.domain
120 beijing2-21vianet-10-77-33-6.idc.qiyi.domain
120 beijing2-21vianet-10-77-33-7.idc.qiyi.domain
120 beijing2-21vianet-10-77-33-8.idc.qiyi.domain
120 beijing2-21vianet-10-77-33-9.idc.qiyi.domain
120 beijing7-ct-10-10-16-17.idc.qiyi.domain
120 chongqing-aipu-101-36-99-92.idc.qiyi.domain
120 dalian-fbwn-49-5-7-4.idc.qiyi.domain
120 fuzhou-wasu-113-215-18-89.idc.qiyi.domain
120 guangzhou-gwbn-211-162-56-69.idc.qiyi.domain
120 guangzhou-gwbn-211-162-56-81.idc.qiyi.domain
120 guangzhou-gwbn-211-162-56-93.idc.qiyi.domain
120 guangzhou-gwbn-211-162-57-227.idc.qiyi.domain
120 guangzhou-gwbn-211-162-57-229.idc.qiyi.domain
120 guangzhou-gwbn-211-162-57-231.idc.qiyi.domain
120 guangzhou-gwbn-211-162-57-233.idc.qiyi.domain
120 guangzhou-scc-103-27-27-34.idc.qiyi.domain
120 guangzhou-scc-103-27-27-38.idc.qiyi.domain
120 guangzhou-scc-103-27-27-48.idc.qiyi.domain
120 guangzhou-scc-103-27-27-50.idc.qiyi.domain
120 jiangxi-crtc-122-72-80-37.idc.qiyi.domain
120 jinan-cmnet-120-192-83-10.idc.qiyi.domain
120 jiyang-cnc-10-153-89-34.idc.qiyi.domain
120 jiyang-cnc-10-153-89-37.idc.qiyi.domain
120 lanzhou2-ct-10-93-80-65.idc.qiyi.domain
120 nanning-gwbn-211-162-50-37.idc.qiyi.domain
120 qingdao-gwbn-42-199-255-38.idc.qiyi.domain
120 qingdao-scc-122-4-76-104.idc.qiyi.domain
120 qlbmonitor-internal-master-online001-bjlt.qiyi.virtual
120 qlbmonitor-internal-master-online001-shgq.qiyi.virtual
120 shanghai6-ct-10-121-33-43.idc.qiyi.domain
120 shanghai-gwbn-124-14-11-81.idc.qiyi.domain
120 shanghai-gwbn-124-14-11-82.idc.qiyi.domain
120 shanghai-gwbn-124-14-11-83.idc.qiyi.domain
120 shanghai-gwbn-124-14-11-84.idc.qiyi.domain
120 shanghai-gwbn-124-14-11-85.idc.qiyi.domain
120 shanghai-gwbn-124-14-11-86.idc.qiyi.domain
120 shijiazhuang5-cnc-10-31-28-10.idc.qiyi.domain
120 suzhou-gwbn-101-247-66-198.idc.qiyi.domain
120 vcache-h612bx1-dongguan3_ct.qiyi.domain
120 vcache-j613bx1-dongguan3_ct.qiyi.domain
120 zhejiang5-cmnet-10-57-170-106.idc.qiyi.domain
120 zhejiang5-cmnet-10-57-170-107.idc.qiyi.domain
142 hangzhou5-wasu-113-215-7-204.idc.qiyi.domain也许你还想看看总数有多少行，需要命令wc 。
Linux系统中的wc(Word Count)命令的功能为统计指定文件中的字节数、字数、行数，并将统计结果显示输出。
如果要查看行数，加上 -l。命令如下：
cat info.log|grep 'updateZabbixAgent||agentName=' | awk -F '=' '{print $2}'|sort|uniq -c|sort -n|wc -l输出结果如下：
260
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
