Compare unique ID's to Create and Delete Times

bpfoster7 · #1 (**permalink**) 11-21-2008

I have thousands of lines a day of data I would like to sort out. Every sessions has the 3 lines below. I want to figure out each sessions length from Creation to Deletion. Every one has a unique session ID

logevent3:<190>Nov 20 08:41:06 000423df255c[4627]: 6|4096|RC|CAC: Created CAC session ID 0000019d1a5501ad7f32 due to Seachange server request|

logevent3:<190>Nov 20 09:06:15 000423df255c[4627]: 6|4145|RC|CAC: Terminated CAC session 0000019d1a5501ad7f32|

logevent3:<190>Nov 20 09:06:15 000423df255c[4627]: 6|4097|RC|CAC: Deleted session ID 0000019d1a5501ad7f32 due to Seachange server request|

logevent3:<190>Nov 20 08:09:13 000423df255c[4627]: 6|4096|RC|CAC: Created CAC session ID 000041df18d50268a8b9 due to Seachange server request|

logevent3:<190>Nov 20 09:39:41 000423df255c[4627]: 6|4145|RC|CAC: Terminated CAC session 000041df18d50268a8b9|

logevent3:<190>Nov 20 09:39:41 000423df255c[4627]: 6|4097|RC|CAC: Deleted session ID 000041df18d50268a8b9 due to Seachange server request|
So what I was thinking about if it's possible is to have. So for the above session it would look like

Session ID Create Time Delete Time Session Length
0000019d1a5501ad7f32 Nov 20 08:41:06 Nov 20 09:06:15 25:09 min
000041df18d50268a8b9 Nov 20 08:09:13 Nov 20 09:39:41 90:28 min

Some of these could be a couple hours in length as well

rubin · #2 (**permalink**) 11-21-2008

Try something like this,

Code:

awk -F'[>| ]'  'BEGIN { print "Session ID      Create Time   Delete Time   Session   Length"}
		       { for(i=8;i++<=NF;)  if ($i~/[0-9]+[a-zA-Z]+/) {split($4 ,a,":");
                         if (b[$i]++==0) {d1=$2OFS$3OFS$4; s1=a[1]*3600+a[2]*60+a[3]} 
                         if (b[$i]==3)   {d2=$2OFS$3OFS$4; s2=a[1]*3600+a[2]*60+a[3]; 
                         printf"%s %s %s %s:%02d min\n", $i, d1, d2, int((s2-s1)/60), (s2-s1)%60}}}' file

Based on your sample, I'm assuming the ID field is somewhere after field 8, and is a combination of numbers & letters.

bpfoster7 · #3 (**permalink**) 11-22-2008

Rubin,

Thanks it worked, kind of.

This is what your command produced.
000041e910c3028af739 Nov 22 21:45:24 Nov 22 21:45:28 0:04 min

This is the data from the file
$ grep 000041e910c3028af739 logevent
<190>Nov 22 21:21:56 000423df255c[4627]: 6|4096|RC|CAC: Created CAC session ID 000041e910c3028af739 due to Seachange server request|
<190>Nov 22 21:45:28 000423df255c[4627]: 6|4145|RC|CAC: Terminated CAC session 000041e910c3028af739|
<190>Nov 22 21:45:28 000423df255c[4627]: 6|4097|RC|CAC: Deleted session ID 000041e910c3028af739 due to Seachange server request|

The Dates don't line up. Looks like it reading the create time from another line. Any other input would be great.
Not sure if it matters, but above lines of data are spaced by many other lines of data.

More UNIX and Linux Forum Topics You Might Find Helpful
Thread	Thread Starter	Forum	Replies	Last Post
compare files and create new with awk	tonet	Shell Programming and Scripting	7	12-27-2007 10:05 AM
Compare 2 list and delete certain names	eltinator	Shell Programming and Scripting	12	08-23-2007 12:45 AM
tar usage and delete/create username	zp523444	Linux	2	12-11-2006 05:18 PM
How to compare several files and create a new one	alxkn	UNIX for Dummies Questions & Answers	1	07-17-2006 11:04 PM
Compare data in 2 files and delete if file exist	lweegp	Shell Programming and Scripting	3	10-13-2005 06:35 AM

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes	Rate This Thread
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode	Rate This Thread: