I think either I'm not understanding where you see the problem, or you're not seeing my solution :)
- The only problems I see are if I'm looking for a point in time, or if a user is logged in for a shorter period of time than the interval of the checkpoints.
Why is there a problem? Say you want to know who was logged on at 13:05 (with hourly checkpoints). So your log will look something like this:
...
12:58:03 User 1 sign on
12:59:03 User 1 sign off
12:59:25 User 2 sign on
12:59:50 User 3 sign on
13:00:00 REPORT: online: (2-12:59:25,3-12:59:50)
13:02:23 User 4 sign on
13:03:12 User 3 sign off
13:04:23 User 4 sign off
13:04:34 User 5 sign on
13:06:52 User 5 sign off
...
(The REPORT line is probably external to the log file, and would probably keep the offset in the file where you should start reading from)
First, the program needs to look at the checkpoint preceeding the beginning of the interval (or the point in time, same thing) - so it knows that at 13:00, there were 2 users online. Then it starts reading the log file from after the checkpoint, keeping track of logons and logoffs, until it passes the end point of the interval (or the point in time). So when it reaches 13:06:52, it stops, and just dumps out it's data:
Users online: 2
User 2 (since 12:59:25)
User 5 (since 13:04:34)
I think my point is, the checkpoints only keep record of historical data up to that point, so you don't have to parse the log file from the beginning of time. It just "primes" your data structure. But from the checkpoint on, you just parse the log file as usual, modifying your data as you go along.
-- Dan
|