按时间检索超大日志

//检索超大日志

//样本

//<166>Mar 31 2007 23:38:50: %PIX-6-302013: Built outbound TCP connection 731528465 for outside:62.241.53.2/443 (62.241.53.2/443) to inside:10.65.160.105/2918 (61.167.117.238/35049)

//

//<167>Mar 31 2007 23:38:50: %PIX-7-710005: UDP request discarded from 10.65.156.20/137 to inside:10.65.255.255/netbios-ns

//

string vFileName = @"C:/temp/sunday2007-04-01.log"; //检索文件名

DateTime vDateTime = DateTime.Parse("Apr 01 2007 01:09:25"); //检索日期

byte[] vBuffer = new byte[0x1000]; //缓冲区

int vReadLength; //读取长度

long vCurrPostion; //当前检索位置

long vBeginPostion; //检索范围开始点

long vEndPostion; //检索范围结束点

 

FileStream vFileStream = new FileStream(vFileName, FileMode.Open, FileAccess.Read);

vBeginPostion = 0;

vEndPostion = vFileStream.Length;

while (true)

{

    vCurrPostion = vBeginPostion + (vEndPostion - vBeginPostion) / 2; //从新计算检索位置

    vFileStream.Seek(vCurrPostion, SeekOrigin.Begin);

 

    vReadLength = vFileStream.Read(vBuffer, 0, vBuffer.Length);

    string vText = Encoding.ASCII.GetString(vBuffer, 0, vReadLength);

    Match vMatch = Regex.Match(vText,

        @"(/r/n)?</d+>(?<datetime>/w+ /d+ /d+ /d+:/d+:/d+):");

    if (!vMatch.Success) break; //没有找到日期

    DateTime vTempTime = DateTime.Parse(vMatch.Result("${datetime}"));

    if (vTempTime == vDateTime)

    {

        vBeginPostion = vCurrPostion;

        vEndPostion = vCurrPostion;

    }

    else if (vDateTime > vTempTime)

    {

        vBeginPostion = vCurrPostion; //如果该位置的日期小，就向后检索

    }

    else

    {

        vEndPostion = vCurrPostion; //如果该位置的日期大，就向前检索

    }

    if (vEndPostion - vBeginPostion < 0x1000) break;

}

 

vCurrPostion = Math.Min(vBeginPostion, vEndPostion); //大概位置已经找到

//向前检索

string vTemp = string.Empty; // 连接处的字符串

vBeginPostion = Math.Max(vCurrPostion - 0x1000, 0);

vEndPostion = vBeginPostion + 0x1000;

while (true)

{

    bool vLoop = false; //是否继续循环

    vFileStream.Seek(vBeginPostion, SeekOrigin.Begin);

    vReadLength = vFileStream.Read(vBuffer, 0, vBuffer.Length);

    string vText = Encoding.ASCII.GetString(vBuffer, 0, vReadLength) + vTemp;

    MatchCollection vMatches = Regex.Matches(vText,

        @"(/r/n)?</d+>(?<datetime>/w+ /d+ /d+ /d+:/d+:/d+):[^/r/n]+/r/n");

    if (vMatches.Count <= 0) break;

    for (int i = 0; i < vMatches.Count; i++)

    {

        DateTime vTempTime = DateTime.Parse(vMatches[i].Result("${datetime}"));

        if (vTempTime == vDateTime)

        {      

            if (i == 0 && vBeginPostion > 0)

            {

                // 需要继续向前检索

                if (vBeginPostion - 0x1000 >= 0)

                {

                    vTemp = vText.Substring(0, 180);

                    vBeginPostion = vBeginPostion - 0x1000;

                    vLoop = true;

                }

                else

                {

                    vTemp = string.Empty;

                    vBeginPostion = 0;

                }

            }

            Console.WriteLine(vMatches[i]);

        }

    }

    if (!vLoop)

    {

        vTemp = vText.Substring(Math.Max(vText.Length - 180, 0));

        break;

    }

}

 

//向后检索

while (true)

{

    bool vLoop = false; //是否继续循环

    vFileStream.Seek(vEndPostion, SeekOrigin.Begin);

    vReadLength = vFileStream.Read(vBuffer, 0, vBuffer.Length);

    string vText = vTemp + Encoding.ASCII.GetString(vBuffer, 0, vReadLength);

    MatchCollection vMatches = Regex.Matches(vText,

        @"(/r/n)?</d+>(?<datetime>/w+ /d+ /d+ /d+:/d+:/d+):[^/r/n]+/r/n");

    if (vMatches.Count <= 0) break;

    for (int i = 0; i < vMatches.Count; i++)

    {

        DateTime vTempTime = DateTime.Parse(vMatches[i].Result("${datetime}"));

        if (vTempTime == vDateTime)

        {

            if (i == 0 && vEndPostion < vFileStream.Length)

            {

                // 需要继续向后检索

                if (vEndPostion + 0x1000 <= vFileStream.Length - 1)

                {

                    vTemp = vText.Substring(0, 180);

                    vEndPostion = vEndPostion + 0x1000;

                    vLoop = true;

                }

                else

                {

                    vTemp = vText.Substring(0, 180);

                    vEndPostion = vFileStream.Length - vEndPostion;

                }

            }

            Console.WriteLine(vMatches[i]);

        }

    }

    if (!vLoop) break;

}

vFileStream.Close();