我能夠做到以下查詢來獲得我一直在尋找的輸出:
cat /var/log/messages* | egrep -i 'usb [0-9]-|mounted|logical blocks' > ${USBDATA}
cat ${USBDATA} | grep "New USB device found" > ${NewUSBDev}
while read line; do
MONTH="`echo ${line} | awk '{print $1}'`" ; # -- Jul
DAY="`echo ${line} | awk '{print $2}'`" # -- day_
HOUR="`echo ${line} | awk '{print $3}' | cut -d':' -f1`:" # -- hour:
MIN="`echo ${line} | awk '{print $3}' | cut -d':' -f2`:" # -- hour:
# -- echo "M:[$MONTH] D:[$DAY] H:[${HOUR}${MIN}]"
cat ${USBDATA} | grep ${MONTH} | grep "${DAY} ${HOUR}${MIN}" > ${CHUNK}
awk '/New USB device found/{p++}p==1' ${CHUNK} > ${TMPFILE}
cp ${TMPFILE} ${CHUNK}
if [ "$(cat $CHUNK| egrep 'MiB|GiB|TiB')" ] && ! [ "$(cat $CHUNK | grep 'Mounted root filesystem')" ] ;then
# -- cat ${CHUNK}
STR="$(less ${CHUNK}|grep 'idProduct' | head -1 | awk '{print $1" "$2" "$3" "$12" "$13}')"
STR="$STR $(less ${CHUNK}|grep 'Product:' | awk '{print ", "$9" "$10" "$11}')"
STR="$STR $(less ${CHUNK}|grep 'Manufacturer:' | awk '{print ", "$9" "$10" "$11}')"
STR="$STR $(less ${CHUNK}|grep 'SerialNumber:' | awk '{print ", "$9}')"
STR="$STR $(less ${CHUNK}|grep 'logical blocks:' | head -1 | awk '{print ", "$13" "$14" "$15" "}')"
echo "${STR}"
echo "${STR}" >> ${DEVICES}
fi
[ -f ${CHUNK} ] && rm ${CHUNK}
done < ${NewUSBDev}
echo "----------------------------------------------"
cat ${DEVICES} | sort -M -k 2 > ${SORTEDDEV}
cat ${SORTEDDEV}
基本上,這是一個有點難看,但它搜索找到的所有「新的USB設備「並列出包含該行的列表。然後抽出與時間戳相匹配的所有內容。然後在「找到新的USB設備」之前抽出所有內容,並在「找到新的USB設備」上進行第二次匹配。
樣品$ {} CHUNK的數據是這樣的:
Sep 30 09:55:10 oc7446274465 kernel: usb 2-1: New USB device found, idVendor=1058, idProduct=071a
Sep 30 09:55:10 oc7446274465 kernel: usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
Sep 30 09:55:10 oc7446274465 kernel: usb 2-1: Product: My Passport 071A
Sep 30 09:55:10 oc7446274465 kernel: usb 2-1: Manufacturer: Western Digital
Sep 30 09:55:10 oc7446274465 kernel: usb 2-1: SerialNumber: 575846314136304130353235
Sep 30 09:55:10 oc7446274465 kernel: usb 2-1: configuration #1 chosen from 1 choice
Sep 30 09:55:22 oc7446274465 kernel: sd 5:0:0:0: [sdb] 1465092096 512-byte logical blocks: (750 GB/698 GiB)
提出這個數據到一個臨時文件,然後裏grep出重要的位。這可以在一定改善,但它的工作原理在目前(grepping不包括在上面的代碼部分):
輸出示例:
Sep 10 16:19:14 idVendor=8564, idProduct=1000 , Mass Storage Device , JetFlash , 2978449637 , (31.6 GB/29.4 GiB)
Sep 14 15:15:04 idVendor=054c, idProduct=0544 , DSC-HX9V , Sony , D89BE0866 , (20.0 MB/19.1 MiB)
Sep 17 19:38:04 idVendor=054c, idProduct=0544 , DSC-HX9V , Sony , D89BE0866 , (31.9 GB/29.7 GiB)
Sep 19 05:23:07 idVendor=054c, idProduct=0544 , DSC-HX9V , Sony , D89BE0866 , (31.9 GB/29.7 GiB)
Sep 30 09:55:10 idVendor=1058, idProduct=071a , My Passport 071A , Western Digital , 57584631413630XXXXXX235 , (750 GB/698 GiB)
因此我得到的時候,ID信息,產品名稱,串行等。我應該包括檢查數據是否丟失。但你明白了。感謝輸入的人。
不要認爲它適用於我...我需要看歷史。 –
另外diskutil不在平臺上。感謝您的幫助。不勝感激。 –