simple log event histograms
Just to preserve it, here’s a useful shell command line to print a histogram of frequent log events:
grep -h 'expr' files | cut -d ' ' -f 1,2 | uniq -c | awk '{step=5; bar = ""; for(i = $1; i>=1; i = i-step) bar = bar "#"; printf $2, $3, bar; }'
Depending on the number of events the step has to be adjusted. The arguments to cut determine the used time intervals; the above aussumes a traditional BSD Syslog timestamp and will yield daily counts. For hourly counts one can use cut -d : -f 1 (then the print command has to be changed as well to printf $2, $3, $4, bar;) — for Syslog-Protocol timestamps one can use cut -d T -f 1 or cut -d : -f 1. Note that only intervals with matches are shown, there is no easy way to add empty lines.
Example:
[mschuett@mail] /var/log> fgrep -h 'idle for too long, closing connection' cyruslog | cut -d T -f 1 | uniq -c | awk '{step=10; bar = ""; for(i = $1; i>=1; i = i-step) bar = bar "#"; print $2, bar; }'
2010-03-01 ########################
2010-03-02 ################################
2010-03-03 #####################
2010-03-04 ##############################
2010-03-05 #################################
2010-03-06 ######################
2010-03-07 ###########################
2010-03-08 #####################
2010-03-09 ###################
2010-03-10 #####################
2010-03-11 ##################