#!/bin/bash
# 把"126 秒那种异常长轮询"和隧道事件对齐，看是不是同一条连接/同一次重连导致的。
set -u

echo "════════ 1. 轮询样本（标出 >90000ms 的）════════"
awk -F'\t' '{m=""; if ($3>90000) m="  <<< 异常（约 2 倍 hold）"; print "  #" $1 "  " $3 "ms  开始 " $4 m}' \
    /root/rp_poll30.tsv 2>/dev/null

echo
echo "════════ 2. 每个异常样本的时间窗内，隧道发生了什么 ════════"
for t in $(awk -F'\t' '$3>90000 {print $4}' /root/rp_poll30.tsv 2>/dev/null); do
    echo "  ── 样本开始于 $t ──"
    # 时间窗 = 开始前 10 秒 到 开始后 140 秒
    hhmm=$(echo "$t" | cut -d: -f1-2)
    for f in /root/lanremote-relay/tunnel.log /root/lanremote-relay/tunnel-h2.log; do
        name=$(basename "$f")
        hits=$(grep -E "T0[0-9]:${hhmm#*:}" "$f" 2>/dev/null | wc -l)
        echo "    $name 这个小时的相关事件: $hits 条"
        grep -E "T0[0-9]:${hhmm#*:}" "$f" 2>/dev/null \
            | grep -E 'Registered|Lost|Failed to dial|Unregistered' | head -8 | sed 's/^/      /'
    done
done

echo
echo "════════ 3. 全部隧道事件按分钟看（找异常样本附近的）════════"
echo "  ── QUIC 最近 60 条连接事件 ──"
grep -E 'Registered|Lost|Unregistered' /root/lanremote-relay/tunnel.log 2>/dev/null \
    | tail -30 | sed -E 's/^(....-..-..T..:..):.*(Registered|Lost|Unregistered)[^ ]*/\1 \2/' | sed 's/^/    /'

echo
echo "════════ 4. watchdog 在这个时间段的记录 ════════"
tail -20 /root/lanremote-relay/watchdog.log 2>/dev/null | sed 's/^/  /'

echo
echo "════════ 5. 中转日志里这两个时间点附近有什么 ════════"
for t in 17:30 17:40; do
    echo "  ── $t 前后 ──"
    grep -E "\[10-07 $t" /root/lanremote-relay/relay.log 2>/dev/null | head -10 | sed 's/^/    /'
done

echo
echo "════════ 6. 中转的线程/连接数（看有没有堆积）════════"
echo "  中转进程线程数: $(ls /proc/$(systemctl show lanremote-relay -p MainPID --value)/task 2>/dev/null | wc -l)"
echo "  中转内存: $(systemctl show lanremote-relay -p MemoryCurrent --value | awk '{printf "%.1f MB", $1/1024/1024}')"
echo "  中转当前请求统计:"
curl -s --max-time 10 http://127.0.0.1:8080/v1/health \
    | python3 -c "import sys,json; d=json.load(sys.stdin); print('   ', {k:d[k] for k in ('totalRequests','uptimeSeconds','devices','sessions') if k in d})" 2>/dev/null