Way to fix/alter time with logresolvemerge.pl

2009-08-02
2013-03-04
  • Ryan Duffner
    Ryan Duffner
    2009-08-02

    Is there a way I can fix times in my logs. I am using logresolvemerge.pl to combine logs and I have a problem with some different log files using different timezones (or set to UTC). I also have a weird bug where even if the server is set to -0600 that it still has a line of +0000 every so often. I was hoping there would be a way to solve all my issues without having to pre-process the logs. Does anyone have a solution.

    If not, does anyone have any code to help me pre-process the logs to modify time/date to fix all logs to UTC (or a specified time zone).

    I can easily see the lines that need modification with something like:
    cat /var/log/httpd/access_log |awk '$6 == "+0000]"'

    ...but I don't really know of the best way to change the time and date of the offending lines to be in line with the rest of the logs.

    I hope somebody here will have a smart solution to this - surely it has come up before?

     
    • Ryan Duffner
      Ryan Duffner
      2009-08-02

      To clarify the issue...this is what is what my logs look like:

      domain.com 1.2.3.4 - - [01/Aug/2009:19:24:51 -0500] "GET /robots.txt HTTP$
      domain.com 1.2.3.4 - - [02/Aug/2009:00:24:53 +0000] "GET / HTTP/1.1" 301 $

      domain.com 4.6.7.9 - - [02/Aug/2009:00:59:46 +0000] "GET /robots.txt HTTP/1$
      domain.com 4.6.7.9 - - [01/Aug/2009:19:59:46 -0500] "GET / HTTP/1.0" 200 16$
      domain.com 4.6.7.9 - - [01/Aug/2009:19:59:46 -0500] "GET /style.css HTTP/$

      domain.com 4.6.2.1 - - [01/Aug/2009:20:17:36 -0500] "GET /robots.txt HTTP/1$
      domain.com 4.6.2.1 - - [02/Aug/2009:01:17:36 +0000] "GET /
      domain.com 4.6.2.1 - - [01/Aug/2009:20:17:37 -0500] "GET /style.css

      I would like to modify the +0000 lines and subtract from the day/time to reflect the -0500 timezone. Or if easier, I would like to modify all -0500 lines and modify date/time to be correct to UTC +0000.

      I hope this better explains the issue.

       
    • Jean-Luc
      Jean-Luc
      2009-08-02

      Hi,

      There is no way to do that without having to pre-process the logs and with the standard code of logresolvemerge.pl. If you have a good knowledge of Perl, you could build this in within logresolvemerge.pl.

      Jean-Luc
      http://www.internetofficer.com/awstats/