grep -rhe "ACS Websocket connection closed for a valid reason" -e "ACS client starting websocket poll loop" /var/log/ecs |
sort |
tail -n +2 |
awk -F'Z' '{ gsub("-"," ",$1); gsub("T"," ",$1); gsub(":"," ",$1);  print mktime($1)}' |
sort -n |
awk '{if(NR%2 == 0){print $1 - _n}; _n=$1}' |
sort -n