Hello,

Do you really have html in your log or did you copy and past this data from a web page? Need to know if this is the actual data Perl will be processing. Also, when posting this data, please surround it with <code> tags so that it is more readable... like this:

2013-08-09 13:00:23,784 DEBUG <a href="?node=SSHD">SSHD</a> - invoke l
+ogin agent <a href="?node=username%3Djoe">username=joe</a>
2013-08-09 13:00:23,791 DEBUG <a href="?node=SSHD">SSHD</a> - login ag
+ent success <a href="?node=username%3Djoe">username=joe</a>
2013-08-09 13:10:29,025 DEBUG <a href="?node=SSHD">SSHD</a> - invoke l
+ogin agent <a href="?node=username%3Dbob">username=bob</a>
2013-08-09 13:10:29,033 DEBUG <a href="?node=SSHD">SSHD</a> - login ag
+ent success <a href="?node=username%3Dbob">username=bob</a>
2013-08-09 13:20:19,841 DEBUG <a href="?node=SSHD">SSHD</a> - invoke l
+ogin agent <a href="?node=username%3Djane">username=jane</a>
2013-08-09 13:20:19,848 DEBUG <a href="?node=SSHD">SSHD</a> - login ag
+ent success <a href="?node=username%3Djane">username=jane</a>
[download]

As for the correlation you're talking about, none of the login pairs take any more than a few milliseconds, is this really what you're trying to compute?