How to calculate the total time a log file covers in Python 2.7?
<p>So I have several log files, they are structured like this:</p>

<pre><code>Sep  9 12:42:15 apollo sshd[25203]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=189.26.255.11 

Sep  9 12:42:15 apollo sshd[25203]: pam_succeed_if(sshd:auth): error retrieving information about user ftpuser

Sep  9 12:42:17 apollo sshd[25203]: Failed password for invalid user ftpuser from 189.26.255.11 port 44061 ssh2

Sep  9 12:42:17 apollo sshd[25204]: Received disconnect from 189.26.255.11: 11: Bye Bye

Sep  9 19:12:46 apollo sshd[30349]: Did not receive identification string from 199.19.112.130

Sep 10 03:29:48 apollo unix_chkpwd[4549]: password check failed for user (root)

Sep 10 03:29:48 apollo sshd[4546]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.12.29.170  user=root

Sep 10 03:29:51 apollo sshd[4546]: Failed password for root from 221.12.29.170 port 56907 ssh2
</code></pre>

<p>There are more dates and times, But this is an example. I was wondering how I would calculate the total time that the file covers. I've tried a few things, and have had about 5 hours of no success.</p>

<p>I tried this first, and it was close, but it didn't work like I wanted it to, it kept repeating dates:</p>

<pre><code>with open(filename, 'r') as file1:
        lines = file1.readlines()
        for line in lines:
            linelist = line.split()
            date2 = int(linelist[1])
            time2 = linelist[2]
            print linelist[0], linelist[1], linelist[2]
            if date1 == 0:
                date1 = date2
                dates.append(linelist[0] + ' ' + str(linelist[1]))
            if date1 &lt; date2:
                date1 = date2
                ttimes.append(datetime.strptime(str(ltime1), FMT) - datetime.strptime(str(time1), FMT))
                time1 = '23:59:59'
                ltime1 = '00:00:00'
                dates.append(linelist[0] + ' ' + str(linelist[1]))
            if time2 &lt; time1:
                time1 = time2
            if time2 &gt; ltime1:
                ltime1 = time2
</code></pre>

<p>We don't have the year, so I took the current year. Read all the lines, convert the month to month index, and parse each date.</p>

<p>Then sort it (so works even if logs mixed) and take first &amp; last item. Substract. Enjoy.</p>

<pre><code>from datetime import datetime

months = ["","Jan","Feb","Mar","Apr","May","Jun","Jul","Aug","Sep","Oct","Nov","Dec"]
current_year = datetime.now().year

dates = list()
with open(filename, 'r') as file1:
    for line in file1:
        linelist = line.split()
        if linelist:  # filter out possible empty lines
            linelist[0] = str(months.index(linelist[0]))  # convert 3-letter months to index
            date2 = int(linelist[1])
            z=datetime.strptime(" ".join(linelist[0:3])+" "+str(current_year),"%m %d %H:%M:%S %Y") # compose &amp; parse the date
            dates.append(z)  # store in list

dates.sort()  # sort the list
first_date = dates[0]
last_date = dates[-1]

# print report &amp; compute time span
print("start {}, end {}, time span {}".format(first_date,last_date,last_date-first_date))
</code></pre>

<p>result:</p>

<pre><code>start 2016-09-09 12:42:15, end 2016-09-10 03:29:51, time span 14:47:36
</code></pre>

<p>Note that it won't work properly between december 31st and january the 1st because of the missing year info. I suppose we could make a guess if we find January &amp; December in the log then assume that it's january from the next year. Unsupported yet.</p>

python