while(<>){ chop; if (/^node=(\S+).*audit\((\d+\....):(\d+)\)/){ if (! $time{$2}{$1}{$3}){ $time{$2}{$1}{$3}=1; } if (/^node=(\S+) type=EOE msg=audit\((\d+\....):(\d+)\)/){ print_data($1,$2,$3); $totalevents++; }else{ push(@{$data{$1}{"$2:$3"}},$_); } } $cnt++; if ($cnt > $agecheck){ # see if entries have aged off and should be written out $date=&dateonly; while (my ($t)=each(%time)){ if ($t < (time() - $age)){ foreach my $host (keys(%{$time{$t}})){ foreach my $event (keys(%{$time{$t}{$host}})){ logit("Aged: node=$host $t:$event"); print_data($host,$t,$event); update_stats(); } } } } $cnt=0; } $totallines++; } #### sub print_data { ... # Dedup the data base on data in the string # Parent: http://www.perlmonks.org/bare/?node_id=104565 # specific post: http://www.perlmonks.org/bare/?node_id=104602 my $singleline=join(" ",@{$data{$host}{"$time:$event"}}); $databefore+=length($singleline); $singleline=~s/((\S+)\s?)/$count{$2}++ ? '' : $1/eg; $dataafter+=length($singleline); print ${$fh} "$singleline\n"; ... }