正则表达式分析日志
$data = "Dec 25 10:02:10 192.168.0.213 syslog-ng[22683]: syslog-ng starting up; version='2.0.6'Dec 25 10:02:23 192.168.0.213 CRON[22595]: pam_unix(cron:session): session closed for user www-data Dec 25 10:02:51 192.168.0.213 shutdown[22761]: shutting down for system reboot Dec 25 10:02:54 192.168.0.213 init: Switching to runlevel: 6 Dec 25 10:03:02 192.168.0.213 kernel: CPU0: Temperature/speed normal Dec 25 10:03:10 192.168.0.213 watchdog[2962]: stopping daemon (5.4) Dec 25 10:03:10 192.168.0.213 wd_keepalive[22852]: starting watchdog keepalive daemon (5.4): int=10 alive=(null) realtime=yes Dec 25 10:03:10 192.168.0.213 wd_keepalive[22852]: stopping watchdog keepalive daemon (5.4) Dec 25 10:03:23 192.168.0.213 rpc.statd[2040]: Caught signal 15, un-registering and exiting. Dec 25 10:03:24 192.168.0.213 ntop[2683]: CLEANUP[t3054491312]: ntop caught signal 15 Dec 25 10:03:24 192.168.0.213 ntop[2683]: THREADMGMT[t3054491312]: ntop RUNSTATE: SHUTDOWN(7)"; preg_match_all('/([\w]{3}[\s]+[\d]{1,2}[\s]+[\d:]{5,8})[\s]+([0-9\.]{7,15})[\s]+([\w\-\.]+?)(?(?=\[[\d]+\])\[([\d]+)\]):(.+)/i',$data,$a);print_r($a);# 讲解#'/([\w]{3}[\s]+[\d]{1,2}[\s]+[\d:]{5,8})[\s]+([0-9\.]{7,15})[\s]+([\w\-\.]+?)(?(?=\[[\d]+\])\[([\d]+)\]):(.+)/i'# 时间匹配开始# [\w]{3} 1,匹配三位任一“字”的字符# [\s]+ 2,匹配多位空白符# [\d]{1,2} 3,匹配由一到两位的数字# [\s]+ 4,匹配多位空白符# [\d:]{5,8} 5,匹配五到八位由十进制数字和冒号组成的字符串 ;# 时间匹配结束# [\s]+ 1,匹配多位空白符# Ip匹配开始# [\d\.]{7,15} 1,匹配七到十五位由十进制数字和点号组成的字符串 ;# Ip匹配结束# [\s]+ 1,匹配多位空白符# 程序匹配开始# ([\w\-\.]+?) 1,匹配任一'字',点号和'-'号.# 程序匹配结束# 端口匹配开始# (?(?=\[[\d]+\])\[([\d]+)\]) 1,条件匹配 如有匹配 [一位或多位十进制数字] 的字符串 则取出数字，即执行后面的 \[([\d]+)\] 匹配.# 端口匹配结束# : 1,匹配冒号# 描述匹配开始# (.+) 1,匹配除了换行符外的任意一个字符（默认情况下）# 描述匹配结束# /i 1,i 模式修正符 “如果设定此修正符，模式中的字符将同时匹配大小写字母” 即 不区分大小写?