in reply to Re^2: Simple awk question
in thread Simple awk question

$time = print $error|print $F[0];

That attempt to pipe one statement to another statement like you would do when piping shell commands won't work.

You've already been shown a couple ways to extract the datestamp.

$error = '2014-06-04T15:24:21-05:00 syslog_dp [0x80e00099][ftp][error]
+ secure-backup(FBB): trans(5487)';

$time = (split /\s/, $error)[0];
print $time, "\n";

# or you could do this:
($time) = $error =~ /^(\S+)/;
print $time, "\n";

[download]

Replies are listed 'Best First'.
Re^4: Simple awk question
by czah7 (Initiate) on Jun 05, 2014 at 19:29 UTC
    Thanks Fishmonger, that worked! I do appreciate it. However simple it was.

    I may have need of a second request though. Not sure if I should start another thread. But the purpose of this script is to watch a log file, and if it sees an error it emails me. The reason for the timestamp is because I am comparing the time, so If it's an old error I don't get alerted. The problem now is that if it's a continuous error that we are aware of, I still don't want to be alerted every 5-10min(whatever interval i decide to run the script). So I need to write the error it found to a log file. And somehow tell it "if you found this error again, and less than 30min has passed, don't send another alert". Does this make sense?

[reply]

      For this purpose, you want the text of the error message as much as the timestamp, to know if the error is the same or different. That should be relatively simple. The question would be how to enforce the time window.

      Two approaches suggest themselves to me. First, store the timestamp and error message in a file. The next time your script runs, read the timestamp from that file and compare to the current time. This will involve learning how to convert strings into a scalar (or object) representing time. There are CPAN modules to help with this; Time::Piece is the first one I found using a simple search. This would be useful skill to have, and in my opinion worth the effort.

      However, a simpler approach would be to write just the error message out to a file (so you can compare it to the next message), and treat the create date of the file as the timestamp. It should be reasonably close to the actual error timestamp (worst case plus the running time interval of your script). And, you can use the -M operator which returns the age of the file in days to determine if it has been 30 minutes or not since you last saw that error.

      use strict;
use warnings;

my $window = 30.0 / 1440; # 30 minutes
my $error_file = 'error.txt';
my $error_message = shift; 
chomp($error_message);
if (! -e $error_file) {
  # generate warning and then
  write_error_file();
} else {
  chomp(my $old_error = `cat $error_file`);
  # two conditions warrant a warning 
  # a) either a new type of error or b) it has been 
  # more than 30 minutes since we last saw this one
  if (($old_error ne $error_message) || (-M $error_file > $window)) {
    # generate warning and then
    write_error_file();
  }
}

sub write_error_file {
  my $ofh;
  print "New error $error_message\n";
  open $ofh,'>',$error_file; 
  print $ofh $error_message;
  close $ofh;
}

      [download]
      1 Peter 4:10
[reply]
[d/l]
        So I already have that sort of function in the script, it turns the date into a number and compares it. It compares the time stampe of the error, with the timestamp of the date the last date that it ran and if it's not an old error, then it alerts. So that means if I have a problem that happens every few seconds, then every time it sees this error it will be a new error. So maybe I need another check to see if it's the same error, don't alert.

        What I was thinking actually was redo'ing how it even checks the error log. Instead of even looking at an "old error", it can grep for everything that was "10 min ago" or 30minutes. Save that to a file, and only search that file. Then all I need to do is make sure my $lasterror isn't the same as my $currenterror or something right?
[reply]

In Section Seekers of Perl Wisdom