Created
September 7, 2021 19:02
-
-
Save dreness/1de1def13c83d19630ab0646ba8f0597 to your computer and use it in GitHub Desktop.
macOS log haystack needler
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/bin/zsh | |
# set -x | |
# Reference: https://dreness.com/blog/archives/155773 | |
usage() { | |
print "$1: Use histograms to explore os_log data. | |
Usage: $1 [-k logKey] [-l logtime] [-h] [predicate] | |
-k Calculate frequency of unique values of this log attribute. | |
Default: processImagePath | |
-l Only query logs written in the last 'logtime' time period. | |
This value is passed directly to log's '--last' option. | |
Default: 2m (two minutes). | |
-h show this help | |
The 'predicate' positional argument (if present) is passed directly to 'log' | |
as the value for the '--predicate' option. This should be a quoted string. | |
Examples: | |
# Look Who's Talking? (over the last 24 hours) | |
% $1 -l 1d | |
# Look Who's Talking Now? (the default time scope is two minutes) | |
% $1 | |
# Format Perspective - display the recent unique kinds of log messages from | |
# Finder | |
% $1 -k formatString 'process = \"Finder\"' | |
" | |
exit 1 | |
} | |
SCRIPT=$(basename $0) | |
LOG="/usr/bin/log" # did you know that 'log' is a zsh builtin? | |
KEY='processImagePath' | |
LAST='2m' | |
LOGQ='' | |
while getopts 'k: l: h' arg; do | |
case $arg in | |
k) KEY=$OPTARG;; | |
l) LAST=$OPTARG;; | |
h) usage ${SCRIPT}; exit 0;; | |
esac | |
done | |
shift $((OPTIND -1)) | |
#printf "1: %s, 2: %s\n" $1 $2 | |
#print "key: $KEY" | |
#print "LAST: $LAST" | |
#print "dollar at: $@" | |
# Any remaining arguments are used as a log query predicate | |
if [[ ! -z $1 ]] | |
then | |
LOGQ=(--predicate $1) | |
fi | |
${LOG} show --info --last "${LAST}" --style ndjson ${LOGQ} | jq ".${KEY}" | sort | uniq -c | sort -n | |
#log show --last 1m --style json $@ | jq ${F} | awk "/${KEY}/ {print \$2}" | sort | uniq -c | sort -n | |
#F=$(printf '.[] | select(.%s != "") | {%s}' ${KEY} ${KEY}) | |
#F=$(printf ".%s" ${KEY}) | |
#${LOG} show --last "${LAST}" --style ndjson "$@" | jq ${F} | awk "/${KEY}/ {print \$2}" | sort | uniq -c | sort -n | |
#${LOG} show --last "${LAST}" --style ndjson "$@" | jq "${F}" | awk "/${KEY}/ {print \$2}" |
Author
dreness
commented
Oct 28, 2021
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment