折腾了点时间，供参考
# -*- coding: utf-8 -*-
__author__ = 'River'
import timeit,os
import re,time
'''
'''
#被监控的文件
log_file="/var/log/messages"
#记录读取的行数
line_file="/var/log/line.log"
##计算文件行数
def linecount(log_file):
count = 0
with open (log_file,'rb') as thefile:
while 1:
buffer = thefile.read(65536)
if not buffer:
break
count += buffer.count('\n')#通过读取换行符计算
return count
try:
##宁愿重复报警，也不能遗漏报警，上次读取的结尾初始化为50%文件行数
end_line=int(linecount(log_file)*0.5)
while 1:
with open (line_file,'r') as fileHandle_line:
try:
#获取上次记录的读取位置
start_line_record=fileHandle_line.readlines()[0:1][0].strip()
start_line = int(start_line_record)
except:
#start_line=int(end_line*0.5)
start_line=int(linecount(log_file)*0.5)
with open (log_file,'r') as fileHandle_log:
try:
fileList = fileHandle_log.readlines()[start_line:]
end_line=start_line
for line in fileList:
end_line=end_line+1
#匹配上正则规则
if re.match(r".*puppet-agent.*\(\/Stage",line):
#过滤出需要的文字：时间、主机名、变更内容
tmp_list=line.strip().split(" ")
action_time=tmp_list[0]+tmp_list[1]+" "+tmp_list[2]+" "+tmp_list[3]
hostname=tmp_list[4]
change=line.strip().split("(")[1]
print action_time +" "+hostname+" "+change
else:
continue
fileList=[]
with open (line_file,'w') as fileHandle_line_w:
#保存本次读到的文件位置
fileHandle_line_w.write(str(end_line))
except:
#start_line=int(end_line*0.5)
fileHandle_line_w.write(str(end_line))
raise "ERROR 读取文件失败%s" %(log_file)
#以5s为间隔，再次从上次记录的位置读取文件
time.sleep(5)
except:
with open (line_file,'w') as fileHandle_line_w:
#异常时保存本次读到的文件位置
fileHandle_line_w.write(str(end_line))