Python日期时间1970-01-01 07:00:07

Question

I have code snippet like this:

import re 
from datetime import datetime as dt 
from pprint import pprint as pp

__lin_regex = "(.*)msg='(.*)'"

events = [
    "type=USER_AUTH msg=audit(1565448223.294:46713): pid=4499 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:authentication op-test acct=\"root\" exe=\"/usr/sbin/sshd\" hostname=49.88.112.75 addr=49.88.112.75 terminal=ssh res=failed'"
]

logs = {}

for event in events:
    vm_info = ['name', 'id']

    results = ''.join(list(re.match(__lin_regex, event).groups()))

    split_results = results.split(' ')

    split_results_length = len(split_results)
    for i in range(0, split_results_length-1):
        if split_results[i].find('=') == -1:
            split_results[i - 1] = split_results[i - 1] + ' ' +  split_results[i]
            split_results.remove(split_results[i])

    pid = split_results.pop(2).split('=')[1]

    if pid not in logs:
        logs[pid] = vm_info + [pid] + [item.split('=')[1] for item in split_results]
    logs[pid][4] = dt.fromtimestamp(int(float(re.findall("([0-9.]+):", logs[pid][4])[0]))).strftime("%Y-%m-%d %H:%M:%S")

pp(logs)

But when I have large amount of events, their output it 1970-01-01 07:00:07, when I try to print 1000 data still works, but when I print it all it didn't work, any idea?

Answer 1

Had a look at your code, and for the sake of it, replaced / added the following lines, which let me do 10,000 events with the same timestamp but different pid's :

events = [
    "type=USER_AUTH msg=audit(1565448223.294:46713): pid=4499 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:authentication op-test acct=\"root\" exe=\"/usr/sbin/sshd\" hostname=49.88.112.75 addr=49.88.112.75 terminal=ssh res=failed'"
] * 10000

for i, event in enumerate(events):
    events[i] = event.replace("pid=4499", "pid="+str(4499+i))

The date string output for all 10,000 events was correct, so I think the issue would likely have to do with (a) your regex, or (b) your input data.

The way I would debug it, if I were you, is to just use pdb , and look for the example output you're seeing, eg:

import pdb

... rest of your code ...

    logs[pid][4] = dt.fromtimestamp(int(float(re.findall("([0-9.]+):", logs[pid][4])[0]))).strftime("%Y-%m-%d %H:%M:%S")
    if logs[pid][4] == "1970-01-01 07:00:07":
        pdb.set_trace()

At that point, in the interactive debugger you can have a look at the variables involved & see what your input event string is that's causing the problem (chances are, the data isn't as well-formatted as you expect it to be). If it's not obvious, you may be able to tell what's going on by just stepping through the code using n & inspecting variable assignments.

You can use !import code; code.interact(local=vars()) !import code; code.interact(local=vars()) in the debugger to bring the local variables into a normal python shell if you're having trouble with name clashes due to debugger commands.