This is much better done at the application level. Log a user id of some kind (usually session cookie based). Then sort by cookie first, then by time. The sorted file is what you need. For really large logs, some kind of map-reduce is warranted.
On Thu, Nov 25, 2010 at 4:39 PM, Andrej van der Zee < [email protected]> wrote: > > The scheme with the connection ID, can it work, or am I misjudging > something completely? Are there alternatives? > >
