Script to find longest running events in log files
While I have found the logging format described in this post to be useful in my scripts, once you get past a few lines, it gets hard to track what took the longest. I wanted to be able to see the top X events in duration, as recorded in my log, without any hand parsing or eyeballing. I have created a script that does just that. The latest version is here in my code repo.
An example log file to parse:
Sent to my script:
Now at a glance I can see what events took the longest to complete. This assumes pairs of logging messages. Line 1, for example, denotes an event starting a process and line 2 an event finishing that process. If the time between line 1 and line 2 is greater than that between line 2 and 3, line 1 would be given as the higher ranking event in duration. This mode wouldn’t therefore be of much use in looking at, say, web server logs (unless you needed to find periods of the least activity, perhaps to schedule a maintenance window…). But when looking at verbose output from scripts performing sequential tasks, it saves a lot of time. You can scan the longest events and select places to optimize if needed.
I tried to add a lot of commentary, as there is a level of particularity approaching obscurity in it currently, as well as provide ample examples and explanation. There are only a few options:
- -h: Show main docstring, example uses, and options with help.
- -f FILE: The log FILE to be parsed.
- -n NUM: The top NUM of deltas to display. Defaults to 10.
- -N: Show all available deltas.
With the caveat that it only currently works the logging format I have standardized on, I think it’s fairly solid, at least for a few-hour project
I’m sure there are a number of ways in which it could be optimized, but it’s fast enough for my needs. It works across multiple day deltas down to milliseconds. If you want to work with a different log format, you should just have to change the parse_log() function.
There were a few interesting problems to solve along the way, such as how to keep track of the line numbers associated with each line, datetime and message components, and timedeltas all the way through the processing, since there might be duplicates in several places. Another was figuring out how to pad each value per column so that things were vertically aligned, and so more readable. The pretty table printer recipes I found were too heavy for me, and I wanted to write my own.
If you have ideas for improvements or features (next on my list is working with multiple log files at once), feel free to email me or fill out my contact form.
April 5, 2009 - 12:15 AM No Comments









