//检索超大日志
//样本
//<166>Mar 31 2007 23:38:50: %PIX-6-302013: Built outbound TCP connection 731528465 for outside:62.241.53.2/443 (62.241.53.2/443) to inside:10.65.160.105/2918 (61.167.117.238/35049)
//
//<167>Mar 31 2007 23:38:50: %PIX-7-710005: UDP request discarded from 10.65.156.20/137 to inside:10.65.255.255/netbios-ns
//
string vFileName = @"C:\temp\sunday2007-04-01.log"; //检索文件名
DateTime vDateTime = DateTime.Parse("Apr 01 2007 01:09:25"); //检索日期
byte[] vBuffer = new byte[0x1000]; //缓冲区
int vReadLength; //读取长度
long vCurrPostion; //当前检索位置
long vBeginPostion; //检索范围开始点
long vEndPostion; //检索范围结束点

FileStream vFileStream = new FileStream(vFileName, FileMode.Open, FileAccess.Read);
vBeginPostion = 0;
vEndPostion = vFileStream.Length;
while (true)
{
    vCurrPostion = vBeginPostion + (vEndPostion - vBeginPostion) / 2; //从新计算检索位置
    vFileStream.Seek(vCurrPostion, SeekOrigin.Begin);

    vReadLength = vFileStream.Read(vBuffer, 0, vBuffer.Length);
    string vText = Encoding.ASCII.GetString(vBuffer, 0, vReadLength);
    Match vMatch = Regex.Match(vText, 
        @"(\r\n)?<\d+>(?<datetime>\w+ \d+ \d+ \d+:\d+:\d+):");
    if (!vMatch.Success) break; //没有找到日期
    DateTime vTempTime = DateTime.Parse(vMatch.Result("${datetime}"));
    if (vTempTime == vDateTime)
    {
        vBeginPostion = vCurrPostion;
        vEndPostion = vCurrPostion;
    }
    else if (vDateTime > vTempTime)
    {
        vBeginPostion = vCurrPostion; //如果该位置的日期小，就向后检索
    }
    else
    {
        vEndPostion = vCurrPostion; //如果该位置的日期大，就向前检索
    }
    if (vEndPostion - vBeginPostion < 0x1000) break;
}

vCurrPostion = Math.Min(vBeginPostion, vEndPostion); //大概位置已经找到
//向前检索
string vTemp = string.Empty; // 连接处的字符串
vBeginPostion = Math.Max(vCurrPostion - 0x1000, 0);
vEndPostion = vBeginPostion + 0x1000;
while (true)
{
    bool vLoop = false; //是否继续循环
    vFileStream.Seek(vBeginPostion, SeekOrigin.Begin);
    vReadLength = vFileStream.Read(vBuffer, 0, vBuffer.Length);
    string vText = Encoding.ASCII.GetString(vBuffer, 0, vReadLength) + vTemp;
    MatchCollection vMatches = Regex.Matches(vText,
        @"(\r\n)?<\d+>(?<datetime>\w+ \d+ \d+ \d+:\d+:\d+):[^\r\n]+\r\n");
    if (vMatches.Count <= 0) break;
    for (int i = 0; i < vMatches.Count; i++)
    {
        DateTime vTempTime = DateTime.Parse(vMatches[i].Result("${datetime}"));
        if (vTempTime == vDateTime)
        {       
            if (i == 0 && vBeginPostion > 0)
            {
                // 需要继续向前检索
                if (vBeginPostion - 0x1000 >= 0)
                {
                    vTemp = vText.Substring(0, 180);
                    vBeginPostion = vBeginPostion - 0x1000;
                    vLoop = true;
                }