Import Logs for Analysis 

Here are the first three entries in a log file from the Debian system function dpkg.

In[1]:=

X StringTake[Import["ExampleData/dpkg.log", "Text"], 183]

Out[1]=

Import the log data. Dates and times are automatically interpreted.

In[2]:=

X dpkgLog = SemanticImport["ExampleData/dpkg.log", Automatic, "Rows"]; Grid[dpkgLog[[1 ;; 3]]]

Out[2]=

Combine the dates and times into single Entity objects for easier analysis.

In[3]:=

X dpkgLog = Prepend[#[[3 ;; -1]], Apply[DateObject, #[[1 ;; 2]]]] & /@ dpkgLog; Grid[dpkgLog[[1 ;; 3]]]

Out[3]=

Visualize the system activity.

In[4]:=

X package[logRow_] := If[logRow[[2]] === "status", logRow[[4]], logRow[[3]]]; action[logRow_] := logRow[[2]]; actions = Union[action /@ dpkgLog]; indexedActions = MapIndexed[#1 -> #2[[1]] &, actions]; actionLabels = List @@@ (Reverse /@ indexedActions); logsByPackage = GatherBy[dpkgLog, package]; logSample = logsByPackage[[1 ;; 60 ;; 10]]; DateListPlot[ Map[{#[[1]], action[#] /. indexedActions} &, logSample, {2}], Axes -> True, FrameTicks -> {Automatic, actionLabels}, ImageSize -> Large, PlotLegends -> Placed[Composition[package, First] /@ logSample, Bottom]]

Out[4]=