Hi,

in this case it would be good to have an example file of your logs to be able to see what you want to do and where the problem is.

But, if I understand the intent of the program right you have a certain pattern to identify session starts and you have a certain pattern to identify session continuation entries. Why don't you do it in one rush?

It seems that you can always identify a line by a session id. As soon as you hit a line you decide whether it's a session start or session cont line. If it's a session start you do somthing like:

my %sessions;
$sessions{$id}->{'start'}->{'line'} = $lineno;
$sessions{$id}->{'start'}->{'timestamp'} = $timestamp;
[download]

For every cont entry you do the following:

$sessions{$id}->{'last'}->{'line'} = $lineno;
$sessions{$id}->{'last'}->{'timestamp'} = $timestamp;
[download]

assuming that the timestamps in the log file a monotonous rising. In the end you have a hash %sessions where every key is a session-id and with the value hash you can do all calculations you want.

Am I wrong in my assumptions?

Regards
McA