|Problems? Is your data what you think it is?|
How to do session times The Right Wayby strider corinth (Friar)
|on Oct 31, 2002 at 17:04 UTC||Need Help??|
strider corinth has asked for the
wisdom of the Perl Monks concerning the following question:
Hey, monks. I've got a bit of a philosophical question for you.
I've worked with log parsing a lot, and a few times the problem of session times has come up. A session, from a log parsing perspective, is what is created when a log contains start and stop records for a login-based service. RADIUS and web sessions are good examples of these.
The problem which the higher ups generally need solved is, "How many people are/were on at <time>?" where <time> may be "now", "5:04:02 yesterday", or "between 2:00 and 10:00 two thursdays ago". How to find answers in a quick and elegant way is more difficult than it probably seems.
The philosophical part is this: there are easy ways to get these answers, but all seem to me to be inefficient and kludgy:
1 - One can run through the log, keeping track of session openings and closings until the specified time (or interval) is reached, and then count. For logs where sessions can be infinite, and for very long logs, this is an extremely poor way of doing things.
2 - One can save logon and logoff times in a data structure, and count the number of sessions for which the time(s) you're looking for fall between the first and last time values. This is a little better, but it still requires running through the whole dataset to find a single answer.
3 - One can also pick a granularity (say, by the hour) and simply track how many sessions exist for each unit of time. This allows one to jump to an answer quickly, but doesn't work if we use a granularity of an hour, and want to know how many sessions existed at 13:02:56 yesterday. If you make the granularity one second, though, your data set ends up huge with a large log.
To summarize, I'm looking for an elegant solution which will allow the discovery of the number of sessions active at a given time (granularity to the second) without traversing the whole data structure to find it, and without logging the number of sessions active each second. Does such a solution exist?
PS: If there's a module, meditation, snippet, or piece of code that does this, you can lash me with a wet noodle. I couldn't find it.
Love justice; desire mercy.