Grep lines from a log based on time specific in minutes

[Vinod Vasudev]

Hi,

I am writing a korn shell script to calculate average response times from a weblogic log. I need to grep lines based on time in minutes specified by a user and display the average time. For e.g. if a user specifies 30 mins, I need to grep transaction lines from the log in the last 30 mins and calculate the average times from that.

Will I be able to do that kind of date/time calculation from a ksh scipt? Also in the logs, this is the timestamp format for the weblogic transactions: 2008.12.04 13:51:15:106 PST. How can I convert back and forth if I use epoch seconds to do this calculation? I can use perl for this but the requirement is do it from a ksh script which I am not very comfortable with. Any help is greatly appreciated. Thanks.

[James R. Ferguson]

Hi:

> How can I convert back and forth if I use epoch seconds to do this calculation? I can use perl for this but the requirement is do it from a ksh script which I am not very comfortable with.

You can write your Korn shell script as you want. Simply use Perl to do the work of converting the log's timestamps into epoch seconds. Look for log records that lie in the epoch second-based range.

For example:

...
E=$(./make_epoch "2008.12.04 13:51:15")
echo ${E}
1228431720

Your current time is given simply from:

C=$(perl -le 'print time')
1228431725

Regards!

...JRF...

[Vinod Vasudev]

Thanks James. The machine they script is going to be run on doesn't have perl installed, thats why I wanted to find out if I could do it purely in ksh. I will get them to install perl on the machine so it makes everybody's life easier :). Appreciate your help! Thanks.

[James R. Ferguson]

Hi (again):

I'm losing it...I forgot to insert the Perl script I'm suggesting:

# cat ./make_epoch
#!/usr/bin/perl
use strict;
use warnings;
use Time::Local;
my $date = shift or die "Timestamp expected\n";
my $fmt = qr{(\d+)\.(\d+)\.(\d+)\s(\d+):(\d+):(\d+)};
die "Wrong format; 'yyyy.mm.dd hh:mm:ss' expected\n" unless $date =~ $fmt;
my ( $yyyy, $mm, $dd, $hrs, $min, $sec ) = ( $date =~ $fmt );
my $epoch = timelocal( $sec, $min, $hrs, $dd, $mm - 1, $yyyy );
print "$epoch\n";
1;

Regards!

...JRF...