Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to calculate time difference between two log messages of /var/log/messages. As we know log messages prefixed by date & time , i want time difference between two log entries.

share|improve this question
What do you mean by 'highest'? Do you want to know the difference between the first and last message in a log file? – Tom Shaw Jun 1 '11 at 11:26
up vote 1 down vote accepted

I've chosen the first and last messages in /var/log/messages to demonstrate, you'll have to modify it to get your own start and end times


start=$(head -n 1 /var/log/messages | awk {'print $1, $2,$3'})
finish=$(tail -n 1 /var/log/messages | awk {'print $1, $2,$3'})

start_secs=$(date -d "$start" +"%s")
finish_secs=$(date -d  "$finish" +"%s")

let diff_secs=($finish_secs - $start_secs)

let days=$diff_secs/86400
let remainder=$diff_secs%86400
let hours=$remainder/3600
let remainder=$remainder%3600
let minutes=$remainder/60
let seconds=$remainder%60
echo "Days = $days, Hours = $hours, Minutes = $minutes, Seconds = $seconds"
share|improve this answer

In bash, once you figure out what date/times you want to use you can write

firsttime="Jun  1 02:00:13"
secondtime="Jun  1 03:00:46"
echo $(( $(date -d "$secondtime" +"%s") - $(date -d "$firsttime" +"%s") ))

Which will give you number of seconds between those two times. If you want to automate finding firsttime and secondtime, you're going to have to tell us what exactly you're looking for in the log.

share|improve this answer
Yes exactly this i want – vnix27 Jun 1 '11 at 13:03

I assume you want to find the largest time gap between two consecutive log messages. If so, see below for a script that should do the trick. I wrote this script a couple of years ago to print out a particular time range from the messages file, and it was pretty easy to customize:

#!/usr/bin/perl -W

use strict;
use Time::Local;

my %MONTHS = ( "Jan" => 0, "Feb" => 1, "Mar" => 2, "Apr" => 3, "May" => 4, "Jun" => 5,
               "Jul" => 6, "Aug" => 7, "Sep" => 8, "Oct" => 9, "Nov" => 10, "Dec" => 11 );

# Messages file doesn't include the year, so we need to assume that
# all messages are less than a year old and make some guesses

my $currenttime = time();
my $currentyear  = (localtime($currenttime))[5];
my $currentmonth = (localtime($currenttime))[4];

my $largestgap;
my $largestgapbefore;
my $largestgapafter;
my $lasttime;
my $lastmsg;

open(FILE, "</var/log/messages") || die "Unable to open messages file: $!\n";
while(<FILE>) {
    /^(...) (..) (..):(..):(..)/;
    my $year = $currentyear;
    if($MONTHS{$1} > $currentmonth) {$year -= 1; } 
    my $time = timelocal($5, $4, $3, $2, $MONTHS{$1}, $year);

    if(defined($lasttime)) {
        my $gap = $time - $lasttime;
        if(!defined($largestgap) || $gap > $largestgap) {
            $largestgap = $gap;
            $largestgapbefore = $lastmsg;
            $largestgapafter  = $_;
    $lasttime = $time;
    $lastmsg  = $_;

if(!defined($lasttime)) {
    print "No entries in log file.\n";

print "Largest gap was: " . $largestgap . " seconds.\n";

print "Entry before the gap: " . $largestgapbefore . "\n";
print " Entry after the gap: " . $largestgapafter . "\n";
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.