bash - Getting Job Downtime in a Logfile if it has a duplicate -

i'm trying figure out how determine corresponding restart time (the last restart before job completed) of specific job abended (abnormal termination).

for example:

• job abc ran @ 5:00
• job abc abended @ 5:03
• it restarted @ 5:05
• job abc abended again @ 5:08
• it restarted again @ 5:10
• job abc completed @ 5:15

in example, can safely assume completion time of job abc first ran @ 5:00 5:15. i’m trying compute downtime of job abc subtracting time last restarted first time abended ( 5:10 – 5:03 = 7mins downtime).

this did first failure , last restart time:

grep abended logfile | head -1   #first failure grep restarted logfile | tail -1 #last restart 

but problem if job abc runs @ 6:00?

let say,

• another job abc ran @ 6:00.
• it abended @ 6:03.
• it restarted @ 6:05
• job abc completed @ 6:07.

i can no longer use head , tail stated above if case.

how can tell if restart @ 6:05 corresponds job abc first abended @ 6:03?

by way, i’m trying create automated tool downtime of job , reference plain text log file auto created every 24hours.

note: i'm using bash script.

cat tmp.log

job abc ran @ 5:00  job abc abended @ 5:03  restarted @ 5:05  job abc abended again @ 5:08  restarted again @ 5:10  job abc completed @ 5:15  job abc ran @ 6:00.  abended @ 6:03.  restarted @ 6:05  job abc completed @ 6:07. 

---

 awk '{if(s==0 && /abended/){s = 1;st = $nf}}{if(s && /restarted/) {et = $nf}}1; /completed/{s=0;print "downtime of job was: "et "-" st}' tmp.log 

this give following output :

job abc ran @ 5:00  job abc abended @ 5:03  restarted @ 5:05  job abc abended again @ 5:08  restarted again @ 5:10  job abc completed @ 5:15 downtime of job was: 5:10-5:03  job abc ran @ 6:00.  abended @ 6:03.  restarted @ 6:05  job abc completed @ 6:07. downtime of job was: 6:05-6:03.