Proper older than current date/time filter parameters

jacomoman · Post by **jacomoman** » Thu Nov 27, 2008 12:19 am

Folks,

As per usual I did a search for this but I don't see any good answers.

Using v1.23.3... In the Event Filter window... If I want to set up a filter that searches for event records older than 3 moths (for example), what are the proper parameters for that screen? Obviously "Date" from the 1st drop-down, then I'd imagine "less than" from the 2nd, but what about the 3rd text entry field? How does one specify something like "TODAY()-90"? Meaning, current date minus 90 days.

I've tried a few different permutations for that text field and I keep seeing "Error parsing date/time" messages in zmfilter.log, so obviously I don't have the format correct.

I looked into zmfilter.pl and the DateTimeToSQL() funtion is ultimately calling UnixDate() passing in whatever is typed into that 3rd text field. What's the BNF (format spec) for what's expected in this text field?

Any help would be appreciated.

Thanks in advance.

-Jac

haus · Post by **haus** » Wed Dec 17, 2008 3:45 am

I think this is covered in the wiki, but you can use:

Date/Time -> greater than -> -2 min

would mean event occurred in the last 2 minutes. I know you can use seconds, minutes, and hours, and probably days...you'll just have to try weeks and months and see if it returns any results.

For your example,

Date/Time -> less than -> -90 days

should achieve the desired result. The way I think of it is, ZM sort of treats the last argument as an epoch date/time, so anything earlier than that would be a lower number, and anything later than that would be a higher number. Not sure if that's how the inner workings go, but that's how I'd do it if I were writing the code.

Post by **cordel** » Wed Dec 17, 2008 4:13 am

It's actually covered in the documentation:
http://www.zoneminder.com/wiki/index.ph ... ing_Events

Although the links to the relative packages involved have been removed since I added it, there is enough there to give you the basics and Google the appropriate documentation for the packages involved.

jacomoman · Post by **jacomoman** » Wed Dec 17, 2008 5:35 pm

haus wrote:I think this is covered in the wiki, but you can use:

Date/Time -> less than -> -90 days

should achieve the desired result.

Yes, this seems to work great. I've tried it with "90 days ago" as well and it appears to have the same results and frankly is more natural than "-90 days".

However, it appears (at least to me - someone else can check and verify) that the Wiki documentation page on this subject is incorrect. It states:

Your second line to find events older than 30 days would be:

[and <Date><greater> -30 days]

Of coarse you could use 30 days ago as well.

This will give you events in the LAST 30 days, not OLDER than 30 days. I've verified that and it would be great if someone with access to the wiki pages could correct this.

Thank you haus and cordel.

-Jac

haus · Post by **haus** » Wed Dec 17, 2008 5:54 pm

I agree, that is wrong. I have a filter that purges any event older than 21 days (keep disk usage down):

Date/Time -> less than -> -21 days

(no limit to results)

It's funny that you like "N days ago" better. Since I'm a bit of a programmer, I like "-N days" because if I write "less than 10 days ago" that implies (to me) "within the last 10 days". But if I write "less than -10 days" I revert back to programmer mode which says "a value lower than the timestamp of 10 days ago". Those two interpretations are opposites!

jacomoman · Post by **jacomoman** » Wed Dec 17, 2008 6:11 pm

haus wrote:It's funny that you like "N days ago" better. Since I'm a bit of a programmer, I like "-N days" because if I write "less than 10 days ago" that implies (to me) "within the last 10 days". But if I write "less than -10 days" I revert back to programmer mode which says "a value lower than the timestamp of 10 days ago". Those two interpretations are opposites!

Hehe, well, this is a bit off-topic, but it's funny how people's brains work. I've been in the software field since 1987 (yes, I'm ancient

) and I've worked on everything from assembly on the 6502 processors (Commodore 64 and Apple IIe) to C/C++ on HPUX minis, and for the past 12 years anything and everything Java-related. So I'm a "bit" of a programmer myself but for some reason the simplicity of "<Date> less than 30 days ago" suits my cobweb mind a little better. I don't know, like I said, it's funny how people's brains work. This is no more apparent than the multitude of other people's code I've had to work on (and fix/retrofit) over the years which invariably makes me go "Ohhh man, what was he thinking?!" LOL.

Apologies for the off-topic comment, and again, thanks for pointing me in the right direction with this filter stuff.

-Jac