Sponsored Content
Top Forums Shell Programming and Scripting Help to parse syslog with perl Post 303037305 by arm on Monday 29th of July 2019 02:27:20 PM
Old 07-29-2019
Help to parse syslog with perl

[QUOTE=arm;303037305]logver=56 idseq=63256900099118326 itime=1563205190 devid=FG-5KDTB18800138 devname=LAL-C1-FGT-03 vd=USER date=2019-07-15 time=18:39:49 logid="0000000013" type="traffic"
subtype="forward" level="notice" eventtime=1563205189 srcip=11.3.3.17 srcport=50544 srcintf="SGI-CORE.123" srcintfrole="undefined" dstip=12.0.1.1 dstport=443 dsti
ntf="FA-SPI.100" dstintfrole="undefined" poluuid="230d4d26-AAAA-51e9-b9d1-7bf4c828f000" sessionid=20639817 proto=6 action="server-rst" policyid=10 policytype="policy" s
ervice="HTTPS" dstcountry="United State" srccountry="Reserved" trandisp="snat" transip=11.1.1.1 transport=5092 duration=71 sentbyte=093 rcvdbyte=213 sentpkt=11 rcv
dpkt=16 appcat="unscanned"

I used below script to parsing 1000000 records
Code:
#!/usr/bin/env perl
use strict;
use warnings;
while( <> ) {
    if ( /^(?=.*eventtime=(\S+))(?=.*srcip=(\S+))(?=.*srcport=(\S+))(?=.*dstip=(\S+))(?=.*dstport=(\S+))(?=.*sessionid=(\S+))(?=.*action=(\S+))(?=.*policyid=(\S+))(?=.*service=(\S+))(?=.*dstcountry=(\S+))(?=.*transip=(\S+))(?=.*transport=(\S+))(?=.*duration=(\S+)).*$/ ) {
            print "$1|$2|$3|$4|$5|$6|$7|$8|$9|$10|$11|$12|$13\n";
                }
                }


the problem here is didn't manage to find the correct "regular expression" to match dstcountry , what I need is to give me "United State" not "United

1563205189|11.3.3.17|50544|12.0.1.1 |443|20585519|"server-rst"|10|"HTTPS"|"United|11.1.1.1|5092|71
 

10 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

CSV File parse help in Perl

Folks, I have a bit of an issue trying to obtain some data from a csv file using PERL. I can sort the file and remove any duplicates leaving only 4 or 5 rows containing data. My problem is that the data contained in the original file contains a lot more columns and when I try ro run this script... (13 Replies)
Discussion started by: lodey
13 Replies

2. Shell Programming and Scripting

Perl Parse Word Cksum help

Hi all, I'm attempting to parse through a .bin file word by word and perform a cksum on each word using perl. I'm new to perl so I dont exactly know how to get started. Any help would be greatly appreciated. Thanks! (1 Reply)
Discussion started by: TeamUSA
1 Replies

3. Shell Programming and Scripting

perl parse line

Dear all anyone willling to help me..i have try so many time but still failed to get the ip address for line when i print the line is like below Connected to 192.168.1.13 #!/usr/local/bin/perl foreach $line(@lines){ if ($line =~ /connected to/) { $line=~/connected to(.*?) /; ... (2 Replies)
Discussion started by: netxus
2 Replies

4. Shell Programming and Scripting

Perl Parse

Hi I'm writing simple perl script to parse the ftp log as below: Local directory now /home/user/testing 227 Entering Passive Mode (192,254,19,34,8,228). 125 Data connection already open; Transfer starting. 09-25-09 02:33PM 25333629 abc.tar 09-14-09 12:50PM 18015752... (1 Reply)
Discussion started by: netxus
1 Replies

5. Shell Programming and Scripting

perl parse log

Hi anyone can help.how can i get all second column data in this log below?? x 799002577959.pdf, 25728 bytes, 51 tape blocks x 800002357216.pdf, 25728 bytes, 51 tape blocks x aadb090910.txt, 80424 bytes, 158 tape blocks x tsese090909.txt, 13974 bytes, 28 tape blocks (4 Replies)
Discussion started by: netxus
4 Replies

6. Shell Programming and Scripting

Parse file contents in perl...

Hi, I have the file like this: #Contents of file 1 are: Dec 10 12:33:44 User1 Interface: Probe Dec 10 12:33:47 uSER1 SOME DATA Dec 10 12:33:47 user1 Interface: MSGETYPE Dec 10 12:34:48 user1 ID: 10. Dec 10 12:33:55 user1 Interface: MSGTYPE Dec 10 12:33:55 user1 Id: 9 ... (1 Reply)
Discussion started by: vanitham
1 Replies

7. Shell Programming and Scripting

Perl parse error

Hello there, I em executing the following command in a perl script to append "\0" to the end of every line in a file: ###command start my $cmd = qx{"C:\\gawk" '{print $0 "\\\0"}' C:\file.txt > C:\file_1.txt}; ###command end But i get the following error: ###error meaasge start... (2 Replies)
Discussion started by: nmattam
2 Replies

8. Programming

Perl parse string

Hi Perl Guys I have another perl question I have the following code that i have written Getopt::Long::config(qw( permute bundling )); my $OPT = {}; GetOptions($OPT, qw( ver=s help|h )) or die "options parsing failed"; This will allow the user to do something like... (4 Replies)
Discussion started by: ab52
4 Replies

9. Shell Programming and Scripting

Perl :: to parse the data from a string.

Hi folks, I have a line in log from which I need to parse few data. Jul 6 00:05:58 dg01aipagnfe01p %FWSM-3-106011: Deny inbound (No xlate) From the above... I need to parse the %FWSM-3-106011: substring. Another example Jul 13 00:08:55 dq01aipaynas01p %FWSM-6-302010: 2 in use, 1661... (3 Replies)
Discussion started by: scriptscript
3 Replies

10. Shell Programming and Scripting

Perl to parse

The below code works great to parse out a file if the input is in the attached SNP format ">". perl -ne 'next if $.==1; while(/\t*NC_(\d+)\.\S+g\.(\d+)()>()/g){printf("%d\t%d\t%d\t%s\t%s\n",$1,$2,$2,$3,$4,$5)}' out_position.txt > out_parse.txt My question is if there is another format in... (10 Replies)
Discussion started by: cmccabe
10 Replies
Locale::Country(3pm)					 Perl Programmers Reference Guide				      Locale::Country(3pm)

NAME
Locale::Country - ISO codes for country identification (ISO 3166) SYNOPSIS
use Locale::Country; $country = code2country('jp'); # $country gets 'Japan' $code = country2code('Norway'); # $code gets 'no' @codes = all_country_codes(); @names = all_country_names(); # semi-private routines Locale::Country::alias_code('uk' => 'gb'); Locale::Country::rename_country('gb' => 'Great Britain'); DESCRIPTION
The "Locale::Country" module provides access to the ISO codes for identifying countries, as defined in ISO 3166-1. You can either access the codes via the "conversion routines" (described below), or with the two functions which return lists of all country codes or all country names. There are three different code sets you can use for identifying countries: alpha-2 Two letter codes, such as 'tv' for Tuvalu. This code set is identified with the symbol "LOCALE_CODE_ALPHA_2". alpha-3 Three letter codes, such as 'brb' for Barbados. This code set is identified with the symbol "LOCALE_CODE_ALPHA_3". numeric Numeric codes, such as 064 for Bhutan. This code set is identified with the symbol "LOCALE_CODE_NUMERIC". All of the routines take an optional additional argument which specifies the code set to use. If not specified, it defaults to the two- letter codes. This is partly for backwards compatibility (previous versions of this module only supported the alpha-2 codes), and partly because they are the most widely used codes. The alpha-2 and alpha-3 codes are not case-dependent, so you can use 'BO', 'Bo', 'bO' or 'bo' for Bolivia. When a code is returned by one of the functions in this module, it will always be lower-case. As of version 2.00, Locale::Country supports variant names for countries. So, for example, the country code for "United States" is "us", so country2code('United States') returns 'us'. Now the following will also return 'us': country2code('United States of America') country2code('USA') CONVERSION ROUTINES
There are three conversion routines: "code2country()", "country2code()", and "country_code2code()". code2country( CODE, [ CODESET ] ) This function takes a country code and returns a string which contains the name of the country identified. If the code is not a valid country code, as defined by ISO 3166, then "undef" will be returned: $country = code2country('fi'); country2code( STRING, [ CODESET ] ) This function takes a country name and returns the corresponding country code, if such exists. If the argument could not be identified as a country name, then "undef" will be returned: $code = country2code('Norway', LOCALE_CODE_ALPHA_3); # $code will now be 'nor' The case of the country name is not important. See the section "KNOWN BUGS AND LIMITATIONS" below. country_code2code( CODE, CODESET, CODESET ) This function takes a country code from one code set, and returns the corresponding code from another code set. $alpha2 = country_code2code('fin', LOCALE_CODE_ALPHA_3, LOCALE_CODE_ALPHA_2); # $alpha2 will now be 'fi' If the code passed is not a valid country code in the first code set, or if there isn't a code for the corresponding country in the second code set, then "undef" will be returned. QUERY ROUTINES
There are two function which can be used to obtain a list of all codes, or all country names: "all_country_codes( [ CODESET ] )" Returns a list of all two-letter country codes. The codes are guaranteed to be all lower-case, and not in any particular order. "all_country_names( [ CODESET ] )" Returns a list of all country names for which there is a corresponding country code in the specified code set. The names are capi- talised, and not returned in any particular order. Not all countries have alpha-3 and numeric codes - some just have an alpha-2 code, so you'll get a different number of countries depending on which code set you specify. SEMI-PRIVATE ROUTINES Locale::Country provides two semi-private routines for modifying the internal data. Given their status, they aren't exported by default, and so need to be called by prefixing the function name with the package name. alias_code Define a new code as an alias for an existing code: Locale::Country::alias_code( ALIAS => CODE [, CODESET ] ) This feature was added as a mechanism for handling a "uk" code. The ISO standard says that the two-letter code for "United Kingdom" is "gb", whereas domain names are all .uk. By default the module does not understand "uk", since it is implementing an ISO standard. If you would like 'uk' to work as the two-letter code for United Kingdom, use the following: Locale::Country::alias_code('uk' => 'gb'); With this code, both "uk" and "gb" are valid codes for United Kingdom, with the reverse lookup returning "uk" rather than the usual "gb". Note: this function was previously called _alias_code, but the leading underscore has been dropped. The old name will be supported for all 2.X releases for backwards compatibility. rename_country If the official country name just isn't good enough for you, you can rename a country. For example, the official country name for code 'gb' is 'United Kingdom'. If you want to change that, you might call: Locale::Country::rename_country('gb' => 'Great Britain'); This means that calling code2country('gb') will now return 'Great Britain' instead of 'United Kingdom'. The original country name is retained as an alias, so for the above example, country2code('United Kingdom') will still return 'gb'. EXAMPLES
The following example illustrates use of the "code2country()" function. The user is prompted for a country code, and then told the corre- sponding country name: $| = 1; # turn off buffering print "Enter country code: "; chop($code = <STDIN>); $country = code2country($code, LOCALE_CODE_ALPHA_2); if (defined $country) { print "$code = $country "; } else { print "'$code' is not a valid country code! "; } DOMAIN NAMES
Most top-level domain names are based on these codes, but there are certain codes which aren't. If you are using this module to identify country from hostname, your best bet is to preprocess the country code. For example, edu, com, gov and friends would map to us; uk would map to gb. Any others? KNOWN BUGS AND LIMITATIONS
o When using "country2code()", the country name must currently appear exactly as it does in the source of the module. The module now sup- ports a small number of variants. Possible extensions to this are: an interface for getting at the list of variant names, and regular expression matches. o In the current implementation, all data is read in when the module is loaded, and then held in memory. A lazy implementation would be more memory friendly. o Support for country names in different languages. SEE ALSO
Locale::Language ISO two letter codes for identification of language (ISO 639). Locale::Script ISO codes for identification of scripts (ISO 15924). Locale::Currency ISO three letter codes for identification of currencies and funds (ISO 4217). Locale::SubCountry ISO codes for country sub-divisions (states, counties, provinces, etc), as defined in ISO 3166-2. This module is not part of the Locale-Codes distribution, but is available from CPAN in CPAN/modules/by-module/Locale/ ISO 3166-1 The ISO standard which defines these codes. http://www.iso.org/iso/en/prods-services/iso3166ma/index.html Official home page for the ISO 3166 maintenance agency. http://www.egt.ie/standards/iso3166/iso3166-1-en.html Another useful, but not official, home page. http://www.cia.gov/cia/publications/factbook/docs/app-d-1.html An appendix in the CIA world fact book which lists country codes as defined by ISO 3166, FIPS 10-4, and internet domain names. AUTHOR
Neil Bowers <neil@bowers.com> COPYRIGHT
Copyright (C) 2002, Neil Bowers. Copyright (c) 1997-2001 Canon Research Centre Europe (CRE). This module is free software; you can redistribute it and/or modify it under the same terms as Perl itself. perl v5.8.0 2002-06-01 Locale::Country(3pm)
All times are GMT -4. The time now is 10:19 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy