syslog.py

# Parse syslog file for logs (per hour) that match message
# Prior art: https://github.com/dabeaz/generators

from dateutil import parser
from collections import Counter
import re

logpats = r"(\S+ \d+ \d+:\d+:\d+) (\S+) (.*]:|.*]\):|.*\):) (.*)"
colnames = ("datetime", "host", "process", "message")
message = "Killed"

loglines = open("/var/log/system.log", "r")
logpat = re.compile(logpats)
groups = (logpat.match(line) for line in loglines)
tuples = (g.groups() for g in groups if g)

log = (dict(zip(colnames, t)) for t in tuples)
parsed = (r for r in log if message in r["message"])
hours = (parser.parse(p["datetime"]).hour for p in parsed)


if __name__ == "__main__":
    msg_per_hour = Counter(hours)
    print(msg_per_hour)