多维度日志日志分析脚本

#!/bin/bash
# 多维度nginx日志分析

LOG_FILE="/var/log/nginx/access.log"

multi_dimension_analysis() {
    echo "=== 多维度分析报告 ==="
    
    # 按小时统计访问量
    echo "24小时访问量分布:"
    awk '{
        time = substr($4, 14, 2)
        hour_count[time]++
    } END {
        for (h=0; h<24; h++) {
            printf "%02d:00-%02d:59  %6d 次", h, h, hour_count[sprintf("%02d", h)]+0
            # 简单的图形化显示
            bars = int((hour_count[sprintf("%02d", h)]+0) / 100)
            for (i=0; i<bars; i++) printf "█"
            printf "\n"
        }
    }' "$LOG_FILE"
    
    # IP地理位置分析 (需要geoip数据库)
    echo "访问来源分析:"
    awk '{print $1}' "$LOG_FILE" | \
    sort | uniq -c | sort -nr | head -20 | \
    while read count ip; do
        # 这里可以集成GeoIP查询
        printf "%-15s %8d 次\n" "$ip" "$count"
    done
    
    # 用户代理分析
    echo "浏览器/爬虫统计:"
    awk -F'"' '{
        ua = $6
        if (ua ~ /bot|spider|crawler/i) type = "爬虫"
        else if (ua ~ /Mobile|Android|iPhone/i) type = "移动端"
        else if (ua ~ /Chrome|Firefox|Safari/i) type = "桌面浏览器"
        else type = "其他"
        ua_type[type]++
    } END {
        for (type in ua_type) {
            printf "%-12s %8d 次\n", type, ua_type[type]
        }
    }' "$LOG_FILE"
    
    # 响应码时间分布
    echo "响应码时间分布:"
    awk '{
        hour = substr($4, 14, 2)
        status = $9
        status_hour[status"_"hour]++
        total_hour[hour]++
    } END {
        for (status in {"200":1, "404":1, "500":1}) {
            printf "\n%s状态码分布:\n", status
            for (h=0; h<24; h++) {
                key = status"_"sprintf("%02d", h)
                count = status_hour[key]+0
                total = total_hour[sprintf("%02d", h)]+0
                if (total > 0) {
                    percentage = count * 100 / total
                    printf "%02d时: %6d次 (%.1f%%)\n", h, count, percentage
                }
            }
        }
    }' "$LOG_FILE"
}

multi_dimension_analysis