Tuesday, January 19, 2010

Perl one-liner to convert ITM timestamps to normal timestamps

One of the annoying aspects of ITM troubleshooting is that the timestamps in the logs are written in epoch time in hexadecimal instead of 'human-readable' format. I don't know the exact reason behind it, but the whole purpose of logs is to aid in troubleshooting and timestamps are critical piece of information in troubleshooting.

Anyway, to convert the log timestamps to normal timestamp, I have been using the following one-liner.

perl -lane 'if (/^(.)([\dA-F]+)(\..*)/) { printf "%s%s%s\n", $1, scalar(localtime(oct("0x$2"))),$3; }' <log-file>

The one-liner can be used to read from pipe as well as below.

tail -100 <log-file> perl -lane 'if (/^(.)([\dA-F]+)(\..*)/) { printf "%s%s%s\n", $1, scalar(localtime(oct("0x$2"))),$3; }'

Hope this makes troubleshooting little easier.

2 comments:

Lanny said...

Great post!! Here's the reason behind the TS fun. Simple answer is that it's an old Candle Omegamon legacy item that never got corrected.

WLS (Big Blue Idiot)

Ricardo said...

Hey Guys, there is a built in solution called ras1log, that convert the timestamps automatically.

Just have to use:

ras1log //log.file

It's available in all ITM 6 bin dir

Ricardo Gelllman - IBM Tivoli annalist.