ITM v6 log files use a hexadecimal timestamp (to save space? who the hell knows), which adds unnecessary effort when the reason you’re looking at the logs is to determine an issue in the first place. In any case…

Here’s the script I wrote when I first encountered the nonsense in ITM v6 logs a few years ago:

#!/bin/perl

foreach (<STDIN>) {
 if (/^[^\s\d\w]+([\w\d]*)/) {
  @t=localtime(hex($1));
  $time=sprintf("%02d:%02d:%02d %02d/%02d/%04d",
  $t[2],$t[1],$t[0],$t[4]+1,$t[3],$t[5]+1900);
  s/^[^\s\w\d]+[\w\d]*/$time/;
 }
  print $_;
}

Here’s a one-liner that Venkat.Saranathan at Gulfsoft.com cranked out, rending my script pretty much obsolete

perl -lane 'if ($_ =\ /^(.)([\dA-F]+)(\..*)/) { printf "%s%s%s", $1, scalar(localtime(oct("0x$2"))),$3; }'