按HOST/Program/OSUser汇总lister log最近 10000行的记录。
echo "CNT     # PROGRAM@HOST[OSUSER]";tail -10000 listener.log | awk  -F"[()=]" '/establish/{
for(i=1;i<=NF;i++){if($i=="PROGRAM")pro=$(i+1);if($i=="HOST")host=$(i+1);if($i=="USER")usr=$(i+1);}cnt[pro"@"host"["usr"]"]++}
END{for(x in cnt)print cnt[x]"\t# "x}'|sort -nr

HOST简版：
按HOST汇总lister log最近 10000行的记录。
echo "CNT     # HOST";tail -10000 listener.log | awk  -F"[()=]" '/establish/{
for(i=1;i<=NF;i++){if($i=="HOST")host=$(i+1)}cnt[host]++}
END{for(x in cnt)print cnt[x]"\t# "x}'|sort -nr

PROGRAM简版：
按HOST汇总lister log最近 10000行的记录。
echo "CNT     # PROGRAM";tail -10000 listener.log | awk  -F"[()=]" '/establish/{
for(i=1;i<=NF;i++){if($i=="PROGRAM")pro=$(i+1)}cnt[pro]++}
END{for(x in cnt)print cnt[x]"\t# "x}'|sort -nr

PROGRAM@HOST简版：
按HOST汇总lister log最近 10000行的记录。
echo "CNT     # PROGRAM@HOST";tail -10000 listener.log | awk  -F"[()=]" '/establish/{
for(i=1;i<=NF;i++){if($i=="PROGRAM")pro=$(i+1);if($i=="HOST")host=$(i+1)}cnt[pro"@"host]++}
END{for(x in cnt)print cnt[x]"\t# "x}'|sort -nr

HOST/Program/OSUser完整版(无排序）：

tail -10000 listener.log | awk  -F"[()=]" '/CONNECT_DATA/{
for(i=1;i<=NF;i++){
if($i=="PROGRAM")pro=$(i+1);
if($i=="HOST")host=$(i+1);
if($i=="USER")usr=$(i+1);
}
cnt[pro"@"host"["usr"]"]++;
cnt_usr[usr]++;
cnt_host[host]++;
cnt_pro[pro]++;
}
END{
print "\n+++++++++++By OSUser+++++++++++++";
print "CNT\t# OSUSER";
for(x in cnt_usr)print cnt_usr[x]"\t# "x
print "\n+++++++++++By Host+++++++++++++";
print "CNT\t# HOST";
for(x in cnt_host)print cnt_host[x]"\t# "x
print "\n+++++++++++By Program+++++++++++++";
print "CNT\t# PROGRAM";
for(x in cnt_pro)print cnt_pro[x]"\t# "x
print "\n+++++++++++By OSUSER/Host/Program+++++++++++++";
print "CNT\t# PROGRAM@HOST[OSUSER]";
for(x in cnt)print cnt[x]"\t# "x
}'

时间趋势/Day: 按天汇总，按天排序
tail -10000 listener.log | awk '/establish/{c=substr($0,1,11);if(c!=f){n++;f=c};d[n"\t"c]++}END{for(x in d)print x"--- "d[x]}'|sort -n
 按天汇总，按次数排序
tail -10000 listener.log | awk '/establish/{c=substr($0,1,11);d[c]++}END{for(x in d)print d[x]"\t"x}'|sort -nr

时间趋势/Hour:按小时汇总，按小时排序
tail -10000 listener.log | awk '/establish/{c=substr($0,1,14);if(c!=f){n++;f=c};d[n"\t"c]++}END{for(x in d)print x"--- "d[x]}'|sort -n
按小时汇总，按次数排序
tail -10000 listener.log | awk '/establish/{c=substr($0,1,14);d[c]++}END{for(x in d)print d[x]"\t"x":00"}'|sort -nr

时间趋势/10min:按10分钟汇总，按10分钟排序
tail -10000 listener.log | awk '/establish/{c=substr($0,1,16);if(c!=f){n++;f=c};d[n"\t"c"0"]++}END{for(x in d)print x"--- "d[x]}'|sort -n
按10分钟汇总，按次数排序
tail -10000 listener.log | awk '/establish/{c=substr($0,1,16);d[c]++}END{for(x in d)print d[x]"\t"x"0"}'|sort -nr

时间趋势/1min:按分钟汇总，按分钟排序
tail -10000 listener.log | awk '/establish/{c=substr($0,1,17);if(c!=f){n++;f=c};d[n"\t"c]++}END{for(x in d)print x"--- "d[x]}'|sort -n
按分钟汇总，按次数排序
tail -10000 listener.log | awk '/establish/{c=substr($0,1,17);d[c]++}END{for(x in d)print d[x]"\t"x}'|sort -nr