"John Doe" <[EMAIL PROTECTED]> wrote in message
news:[EMAIL PROTECTED]
> Robert Hicks am Dienstag, 10. Januar 2006 18.16:
> > I have an application log that shows the "time", "id" and "type" for a
user
> > logging in. A short except looks like this:
> >
> > 19/12/2005 07:28:37 User (guest) logging in from (LIMS-CIT) - Assigned
> > Userno (7045)
> > 19/12/2005 07:32:06 User (guest) logging in from (LIMS-CIT) - Assigned
> > Userno (1959)
> > 19/12/2005 07:51:38 User (guest) logging in from (LIMS-CIT) - Assigned
> > Userno (7601)
> > 19/12/2005 07:54:10 User (guest) logging off - Userno (7601)
> >
> Are you interested in one specific Userno only, or do you want the login
times
> for all Usernos?
>
> What do you mean by "could log in and log out multiple times"? In
parallel, or
> sequential? If parallel: Are different Usernos assigned for the same user
> logged in multiple times?
>
I am not really interested in the "user" per se just the "Userno" but that
can appear several times in the log
for both logins and logouts.
So I need to first find the login line and Userno and then find the first
logout line with the Userno and then
do a time diff.
> A hash (or hash of hashes / hash of arrays) could be useful to lookup
Usernos
> or login times.
I am reading up on the HoH as well.
> Have you some code to post, f.e. the part extracting the wanted info from
the
> lines?
I have only created a regex so far to split the information out and doing
some counts. Code is below:
use strict;
use warnings;
use English;
use Carp;
my $filename = 'test.log';
open my $LOG, '<', $filename or croak "Can't open '$filename': $OS_ERROR";
# Test line from logfile
#$_ = "19/12/2005 08:53:31 ECP3.2.01.1008I : User (guest) logging in from
(LIMS-CIT) - Assigned Userno (A50C)";
# This parses a login entry
while (<$LOG>) {
my ( $date, $time, $ecp, $login_message, $login_type, $login_loc,
$userno,
$userid )
= / # regex begins
^ # string anchor
(\d{2}.\d{2}.\d{4}) # $date
\ # literal space
(\d+:\d+:\d+) # $time
\ # literal space
(ECP\d.\d.\d{2}.\w{5}) # $ecp
\ # literal space
: # literal :
\ # literal space
(User\s\([\S.]+\)) # $login_message
\ # literal space
(logging\sin) # $login_type
\ # literal space
(from\s\([\S.]+\)) # $login_loc
\ # literal space
- # literal -
\ # literal space
(Assigned\sUserno) # $userno
\ # literal space
\( # literal (
(\w{4}) # $userid
\) # literal )
/xms; # regex ends
print join "\n", $date, $time, $ecp, $login_message, $login_type,
$login_loc, $userno, $userid, "\n";
last; # I only want one line returned from the log for testing
}
This prints out:
19/12/2005
07:28:37
ECP3.2.01.1008I
User (guest)
logging in
from (LIMS-CIT)
Assigned Userno
7045
--
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
<http://learn.perl.org/> <http://learn.perl.org/first-response>
