Re: Parsing a specific section of a log file

Personally, for tasks like this, I usually use File::ReadBackwards and Time::Local qw(timelocal_nocheck) to quickly read only the recent lines (and stop reading when things get) $too_old.

In fact, I learned about Time::Local at this site, asking a related question: Fast date parsing.

-Paul

Comment on Re: Parsing a specific section of a log file Select or Download Code

Replies are listed 'Best First'.
Re^2: Parsing a specific section of a log file by been42 (Curate) on Feb 28, 2007 at 22:00 UTC
Wow, I didn't know about File::ReadBackwards! I'll have to try that. Here's what I've been doing to parse an Apache error log at work that's never been rotated. I use a start date and an end date, but I think the same principle should apply to times. `use Tie::File; tie my @lines, 'Tie::File', 'error.log'; LINE: for (my $i=$#lines; $i >= 0; $i--) { my $d = substr($lines[$i], 1, 24); my $file_date = $time{"yyyy-mm-dd", ParseDate($d)}; next LINE if ($file_date gt $edate); last LINE if ($file_date lt $sdate); # process here }` [download]	[reply] [d/l]
Re^3: Parsing a specific section of a log file by jettero (Monsignor) on Feb 28, 2007 at 22:08 UTC
The reason I suggested Time::Local, though: if your dates are all identicaly shapped and speed is an issue (which it may be at 5 minute intervals) then it's like a million times faster to use `timelocal_nocheck`. It's more work too, but it can be worth it in some situations. Er, I guessed `ParseDate` was from Date::Manip. -Paul	[reply] [d/l] [select]
Re^4: Parsing a specific section of a log file by been42 (Curate) on Feb 28, 2007 at 22:31 UTC
Yep, that's the ParseDate from Date::Manip. Some work popped up in the middle of posting and I forgot to put everything in there. We run our script a few times a day, but I'm not sure if ParseDate would be fast enough to process data in time for you to do anything useful with it in a 5-minute window. It's just what we use at work because we have to deal with so many date formats in different files. Also because we're about 50% people who like 'MM/DD/YYYY' dates and 50% people who like 'YYYY-MM-DD' dates, and ParseDate was the easiest way to resolve that conflict.	[reply]


XP is just a number
	PerlMonks