OK...I am hoping that Perl is the a

[Flipster]

OK...I am hoping that Perl is the answer for this....


I have a log file that updates every minute with the following.


[2002-10-02 09:38:11]: subject=TESTSTATS.TESTHOST.1029, message={HOST="TESTHOST" TID=1029 CONNS=6 BPS=3649}
[2002-10-02 09:38:11]: subject=TESTSTATS.TESTHOST2.1286, message={HOST="TESTHOST2" TID=1286 CONNS=6 BPS=8365}
[2002-10-02 09:38:11]: subject=TESTSTATS.TESTHOST.1800, message={HOST="TESTHOST" TID=1800 CONNS=5 BPS=11921}
[2002-10-02 09:38:11]: subject=TESTSTATS.TESTHOST2.1543, message={HOST="TESTHOST2" TID=1543 CONNS=6 BPS=17068}
[2002-10-02 09:39:11]: subject=TESTSTATS.TESTHOST.1029, message={HOST="TESTHOST" TID=1029 CONNS=6 BPS=4101}
[2002-10-02 09:39:11]: subject=TESTSTATS.TESTHOST2.1286, message={HOST="TESTHOST2" TID=1286 CONNS=6 BPS=7370}
[2002-10-02 09:39:11]: subject=TESTSTATS.TESTHOST.1800, message={HOST="TESTHOST" TID=1800 CONNS=5 BPS=7866}
[2002-10-02 09:39:11]: subject=TESTSTATS.TESTHOST2.1543, message={HOST="TESTHOST2" TID=1543 CONNS=6 BPS=9591}
[2002-10-02 09:40:11]: subject=TESTSTATS.TESTHOST.1286, message={HOST="TESTHOST" TID=1286 CONNS=6 BPS=8377}
[2002-10-02 09:40:11]: subject=TESTSTATS.TESTHOST2.1029, message={HOST="TESTHOST2" TID=1029 CONNS=6 BPS=4015}
[2002-10-02 09:40:11]: subject=TESTSTATS.TESTHOST.1543, message={HOST="TESTHOST" TID=1543 CONNS=6 BPS=8631}
[2002-10-02 09:40:11]: subject=TESTSTATS.TESTHOST2.1800, message={HOST="TESTHOST2" TID=1800 CONNS=5 BPS=5946}
[2002-10-02 09:41:11]: subject=TESTSTATS.TESTHOST.1029, message={HOST="TESTHOST" TID=1029 CONNS=6 BPS=4176}
[2002-10-02 09:41:11]: subject=TESTSTATS.TESTHOST2.1286, message={HOST="TESTHOST2" TID=1286 CONNS=6 BPS=7627}
[2002-10-02 09:41:11]: subject=TESTSTATS.TESTHOST.1543, message={HOST="TESTHOST" TID=1543 CONNS=6 BPS=7107}
[2002-10-02 09:41:11]: subject=TESTSTATS.TESTHOST2.1800, message={HOST="TESTHOST2" TID=1800 CONNS=5 BPS=7043}
[2002-10-02 09:42:11]: subject=TESTSTATS.TESTHOST.1029, message={HOST="TESTHOST" TID=1029 CONNS=6 BPS=4376}
[2002-10-02 09:42:11]: subject=TESTSTATS.TESTHOST2.1286, message={HOST="TESTHOST2" TID=1286 CONNS=6 BPS=8427}
[2002-10-02 09:42:11]: subject=TESTSTATS.TESTHOST.1543, message={HOST="TESTHOST" TID=1543 CONNS=6 BPS=6843}
[2002-10-02 09:42:11]: subject=TESTSTATS.TESTHOST2.1800, message={HOST="TESTHOST2" TID=1800 CONNS=5 BPS=6835}
[2002-10-02 09:43:11]: subject=TESTSTATS.TESTHOST.1029, message={HOST="TESTHOST" TID=1029 CONNS=6 BPS=4198}
[2002-10-02 09:43:11]: subject=TESTSTATS.TESTHOST2.1286, message={HOST="TESTHOST2" TID=1286 CONNS=6 BPS=7975}




In real time, I need to add the number in the "CONNS=" field every minute, for each host (TESTHOST and TESTHOST2) and graph it. The plotting is relatively easy as I am pretty familiar with GNUPlot. However, I am having a hard time scripting something to search for like minutes for each host and add the field then print the hostname, time, and the total connections to a new logfile for plotting. Any help would be appreciated.

 

[justice41]

I would capture the time, host, and conn into a hash of hashes. The keys of the hash are the hostnames and the value is a refence to a hash whose keys are the time, the values of which are the total connections for that time. Looping through the file you can capture the values and build the data structure like

    if ( ($time,$host,$cons) = /\[[-\d]+ ([\d:]+)\].*?HOST="(\w+)".*?CONNS=(\d+)/ ) {

        $hosts{ $host }{ $time } += $cons;
    }

jaa