find_gap.py

#!/usr/bin/python

import sys
from time import mktime, strptime
from datetime import datetime

threshold = 2000000000

# 116260 15:45:30.398605232 3 keepalived (10400) > sendmsg fd=13(<4r>192.168.205.8->224.0.0.18) size=40 tuple=0.0.0.0:112->224.0.0.18:0
def process_line(line):
        parsed = parse_line(line)
        time = parsed[1].split('.')
        return (parsed[0], time[0], time[1])


def parse_line(line):
        return line.split(' ')

def process_itm(id, time, ns):
        time_struct = strptime("2014 %s" % time, '%Y %H:%M:%S')
        seconds = datetime.fromtimestamp(mktime(time_struct))
        return (id, int(seconds.strftime("%s")) * 1000000000 + int(ns))

old_ns = -1
old_id = -1
for line in sys.stdin:
        itm = process_line(line.strip())
        (id, ns) = process_itm(*itm)
        if old_ns != -1:
                diff = ns - old_ns
                if diff > threshold:
                        print "old: %s, %d -> next: %s, %d; diff: %d" % (old_id, old_ns, id, ns, diff)
        old_ns = ns
        old_id = id