in reply to Calculating time between two events in a log.

Here is a solution using Time::Local, (Time::Local was first released with perl 5). 
#!/usr/bin/perl
use strict;
use warnings;
use Time::Local qw/ timegm /; # first released with perl 5

my %invoke;
while (<DATA>) {
    my (undef, $ms, @dt) = reverse split /\D/, $_, 8;

    
    $dt[4] -= 1; # months are '0' based
    my $epoch = timegm @dt;

    
    if (/invoke/) {
        @invoke{ qw/ epoch ms / } = ($epoch, $ms);
    }
    elsif (/success/) {
        my $seconds = $epoch - $invoke{epoch};
        my $millisecs = $ms - $invoke{ms};
        printf "diff - secs: %2d ms: %3d\n", $seconds, $millisecs;
    }
}

__DATA__
2013-08-09 13:00:23,784 DEBUG [SSHD] - invoke login agent [username=jo
+e]
2013-08-09 13:00:23,791 DEBUG [SSHD] - login agent success [username=j
+oe]
2013-08-09 13:10:29,025 DEBUG [SSHD] - invoke login agent [username=bo
+b]
2013-08-09 13:10:29,033 DEBUG [SSHD] - login agent success [username=b
+ob]
2013-08-09 13:20:19,841 DEBUG [SSHD] - invoke login agent [username=ja
+ne]
2013-08-09 13:20:19,848 DEBUG [SSHD] - login agent success [username=j
+ane]

[download]

Replies are listed 'Best First'.
Re^2: Calculating time between two events in a log.
by Anonymous Monk on Aug 13, 2013 at 19:20 UTC
    Correction to the script 
        elsif (/success/) {
        if ($ms < $invoke{ms}) {
            $ms += 1000;
            $epoch -= 1;    
        }
        my $seconds = $epoch - $invoke{epoch};
        my $millisecs = $ms - $invoke{ms};
        printf "diff - secs: %2d ms: %3d\n", $seconds, $millisecs;
    }

    [download]
[reply]
[d/l]
      I like this approach. Would you mind sharing the wisdom behind this?
[reply]

In Section Seekers of Perl Wisdom