One of the annoying aspects of ITM troubleshooting is that the timestamps in the logs are written in epoch time in hexadecimal instead of 'human-readable' format. I don't know the exact reason behind it, but the whole purpose of logs is to aid in troubleshooting and timestamps are critical piece of information in troubleshooting.
Anyway, to convert the log timestamps to normal timestamp, I have been using the following one-liner.
perl -lane 'if (/^(.)([\dA-F]+)(\..*)/) { printf "%s%s%s\n", $1, scalar(localtime(oct("0x$2"))),$3; }' <log-file>
The one-liner can be used to read from pipe as well as below.
tail -100 <log-file> perl -lane 'if (/^(.)([\dA-F]+)(\..*)/) { printf "%s%s%s\n", $1, scalar(localtime(oct("0x$2"))),$3; }'
Hope this makes troubleshooting little easier.
Subscribe to:
Post Comments (Atom)
2 comments:
Great post!! Here's the reason behind the TS fun. Simple answer is that it's an old Candle Omegamon legacy item that never got corrected.
WLS (Big Blue Idiot)
Hey Guys, there is a built in solution called ras1log, that convert the timestamps automatically.
Just have to use:
ras1log //log.file
It's available in all ITM 6 bin dir
Ricardo Gelllman - IBM Tivoli annalist.
Post a Comment