Ok. You need to create some datastore on your side. I would recommend some lite-weight database, like DBD::SQLite. You would then enter something for the downtime event. When you parse an uptime event, you will find the corresponding downtime event, delete it from your datastore, and send the full message to the Unix server. Something like:
  1. Parse the syslog file.
  2. For each event, do:
    1. If downtime event, enter event into local datastore.
    2. If uptime event, do:
      1. Find corresponding downtime event in local datastore.
      2. If it doesn't exist, error out.
      3. If it does, create string to send to Unix server.
      4. Send string to Unix server.
      5. Delete downtime event from local datastore.

The reason you want to delete the matched downtime event is you want to trap a duplicate message for the uptime event. (It sounds stupid, but there's very little cost associated and you trap a potential issue.)

As for how to do it ... knowing what you're trying to do is half the battle. Try your hand at coding up the above pseudo-code. Post here with any problems you run into.

------
We are the carpenters and bricklayers of the Information Age.

The idea is a little like C++ templates, except not quite so brain-meltingly complicated. -- TheDamian, Exegesis 6

... strings and arrays will suffice. As they are easily available as native data types in any sane language, ... - blokhead, speaking on evolutionary algorithms

Please remember that I'm crufty and crochety. All opinions are purely mine and all code is untested, unless otherwise specified.

In reply to Re6: comma delimited, syslog parsing by dragonchild
in thread comma delimited, syslog parsing by jeff061

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.