First of all, I just started learning `awk` and I'd like to challenge myself to pull this off in `bash`, so I'm not looking for the whole answer just some hints here and there, the way to do it, not the solution.


I basically get a big log file like this and I have to sort it out as follows:
- user logged in, user changed password, user logged off within same second (all 3 actions have to be done within 1 second);
- those actions (log in, change password, log off) happened one after another with no other entire in between.
 
So my output will need to be like this, only the profile names of the users that match the tests above.
```
fxsciaqulmlk
erdsfsdfsdf
```


Here I have a portion of the log file
```
Mon, 22 Aug 2016 13:15:39 +0200|178.57.66.225|fxsciaqulmlk| - |user logged in| -
Mon, 22 Aug 2016 13:15:39 +0200|178.57.66.225|fxsciaqulmlk| - |user changed password| -
Mon, 22 Aug 2016 13:15:39 +0200|178.57.66.225|fxsciaqulmlk| - |user logged off| -
Mon, 22 Aug 2016 13:15:42 +0200|178.57.66.225|faaaaaa11111| - |user logged in| -
Mon, 22 Aug 2016 13:15:40 +0200|178.57.66.215|terdsfsdfsdf| - |user logged in| -
Mon, 22 Aug 2016 13:15:49 +0200|178.57.66.215|terdsfsdfsdf| - |user changed password| -
Mon, 22 Aug 2016 13:15:49 +0200|178.57.66.215|terdsfsdfsdf| - |user logged off| -
Mon, 22 Aug 2016 13:15:59 +0200|178.57.66.205|erdsfsdfsdf| - |user logged in| -
Mon, 22 Aug 2016 13:15:59 +0200|178.57.66.205|erdsfsdfsdf| - |user logged in| -
Mon, 22 Aug 2016 13:15:59 +0200|178.57.66.205|erdsfsdfsdf| - |user changed password| -
Mon, 22 Aug 2016 13:15:59 +0200|178.57.66.205|erdsfsdfsdf| - |user logged off| -
Mon, 22 Aug 2016 13:17:50 +0200|178.57.66.205|abcbbabab| - |user logged in| -
Mon, 22 Aug 2016 13:17:50 +0200|178.57.66.205|abcbbabab| - |user changed password| -
Mon, 22 Aug 2016 13:17:50 +0200|178.57.66.205|abcbbabab| - |user changed profile| -
Mon, 22 Aug 2016 13:17:50 +0200|178.57.66.205|abcbbabab| - |user logged off| -
Mon, 22 Aug 2016 13:19:19 +0200|178.56.66.225|fxsciaqulmla| - |user logged in| -
Mon, 22 Aug 2016 13:19:19 +0200|178.56.66.225|fxsciaqulmla| - |user changed password| -
Mon, 22 Aug 2016 13:19:19 +0200|178.56.66.225|fxsciaqulmla| - |user logged off| -
Mon, 22 Aug 2016 13:20:42 +0200|178.57.67.225|faaaa0a11111| - |user logged in| -
```


Here is were I got stuck.
```
#!/bin/bash

LIMIT="3"
LOG_FILE="${1}"


if [[ ! -e "${LOG_FILE}" ]]; then
 echo "Cannot open log file: ${LOG_FILE}" >&2
 exit 1
else
 grep 'changed password' -B1 -A1 ${LOG_FILE} \
 | awk '{print $5"\t"$6"\t"$9" "$10}' \
 | awk 'BEGIN{FS="|"; OFS="\t"} {print $1,$3,$4}' \
 | cut -d "	" -f1,3,4,5

....

fi

```
### My logic is as follows: I'd like to check if the "changed password" string is on the line right after the "logged in" and before the "logged out" - if these are a match then I will want to compare if the actions were done within the same seconds. 

#### Please let me know if my logic is good and what within `awk` I would need to use to get this done. I want to learn along the way, so if you can explain something, it's very much appreciated it. Thank you!