Perl spies on a sniffer
Always an Event
In contrast, the event
database table stores the timeline for the events snapped up by the Zeitgeist daemon. The SQL query in Figure 5 retrieves a few recent sample records of events along with their matching timestamps. Numeric indexes are used to reference other tables, for example, uri
, in which the index is mapped to a text entry.
The timestamp format used by Zeitgeist in the timestamp
column, however, is not one that is directly supported by SQLite; instead, it gives you the Unix time since 1970 in seconds, followed by three more digits that give you thousandths of seconds.
Listing 2 extracts the desktop actions for the last 12 hours from the event
table. It needs to convert the Zeitgeist date in the SQL command it sends as follows
Listing 2
apps-recent
date(substr(timestamp,1,10),'unixepoch')
into SQLite format. With this in place, it can easily compare the recorded timestamps with the time window defined in the SQLite dialect in the form of a handy date('now', '-12 hours')
expression.
The while
loop as of line 22 processes all result records and accumulates the application URLs in the %apps
hash. The for
loop as of line 28 then groups the entries in descending order by counter status and outputs the results.
Figure 6 shows the output from Listing 2; it seems that an xterm window was opened 18 times in the period under review, and that I created a total of six screenshots.
Monitoring Time Clock
How much work did the user put in during the past 24 hours? Did the user just click around on the desktop? Listing 3 discovers such things by searching through the event
activity table for the previous day's entries and incrementing a counter for each hour by one if a desktop event occurred in the time slot.
Listing 3
last-24-hours
Burning the Midnight Oil
The %activity
hash in line 28 increments by one if an event occurs within a specific hour. Finally, the while
loop in lines 36-41 only needs to count up hour by hour from the previous day's date to the present and output the events using printf
.
The output in Figure 7 confirms that the user only worked between 7pm and 11pm – true to the motto that "lazy people get busy at night." Or, maybe it was because the not-so-lazy user was working hard all day at the office and then sat down at their home computer in the evening to compose an article for Linux Pro Magazine?
Infos
- Zeitgeist project on Launchpad: https://launchpad.net/zeitgeist
- Listings for this article: ftp://ftp.linux-magazine.com/pub/listings/magazine/176 IE:
« Previous 1 2
Buy this article as PDF
(incl. VAT)