Login or Register to Ask a Question and Join Our Community

Sponsored Content
Full Discussion: Help to parse syslog with perl
Top Forums Shell Programming and Scripting Help to parse syslog with perl Post 303037309 by Chubler_XL on Monday 29th of July 2019 04:17:59 PM
Old 07-29-2019
Try this:

Code:
#!/usr/bin/env perl
use strict;
use warnings;
while( <> ) {
    if ( /^(?=.*eventtime=(\S+))(?=.*srcip=(\S+))(?=.*srcport=(\S+))
           (?=.*dstip=(\S+))(?=.*dstport=(\S+))(?=.*sessionid=(\S+))
           (?=.*action=(\S+))(?=.*policyid=(\S+))(?=.*service=(\S+))
           (?=.*dstcountry=("[^"]+"|\S+))(?=.*transip=(\S+))
           (?=.*transport=(\S+))(?=.*duration=(\S+)).*$/x ) {
            print "$1|$2|$3|$4|$5|$6|$7|$8|$9|$10|$11|$12|$13\n";
                }
                }

--- Post updated at 07:17 AM ---

Or if the quote are always there you can drop the |\S+ and if you want to strip the quotes use (?=.*dstcountry="([^"]+)")
Last edited by Chubler_XL; 07-29-2019 at 05:11 PM.. Reason: wrap long line
This User Gave Thanks to Chubler_XL For This Post:
arm
 

10 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

CSV File parse help in Perl

Folks, I have a bit of an issue trying to obtain some data from a csv file using PERL. I can sort the file and remove any duplicates leaving only 4 or 5 rows containing data. My problem is that the data contained in the original file contains a lot more columns and when I try ro run this script... (13 Replies)
Discussion started by: lodey
13 Replies

2. Shell Programming and Scripting

Perl Parse Word Cksum help

Hi all, I'm attempting to parse through a .bin file word by word and perform a cksum on each word using perl. I'm new to perl so I dont exactly know how to get started. Any help would be greatly appreciated. Thanks! (1 Reply)
Discussion started by: TeamUSA
1 Replies

3. Shell Programming and Scripting

perl parse line

Dear all anyone willling to help me..i have try so many time but still failed to get the ip address for line when i print the line is like below Connected to 192.168.1.13 #!/usr/local/bin/perl foreach $line(@lines){ if ($line =~ /connected to/) { $line=~/connected to(.*?) /; ... (2 Replies)
Discussion started by: netxus
2 Replies

4. Shell Programming and Scripting

Perl Parse

Hi I'm writing simple perl script to parse the ftp log as below: Local directory now /home/user/testing 227 Entering Passive Mode (192,254,19,34,8,228). 125 Data connection already open; Transfer starting. 09-25-09 02:33PM 25333629 abc.tar 09-14-09 12:50PM 18015752... (1 Reply)
Discussion started by: netxus
1 Replies

5. Shell Programming and Scripting

perl parse log

Hi anyone can help.how can i get all second column data in this log below?? x 799002577959.pdf, 25728 bytes, 51 tape blocks x 800002357216.pdf, 25728 bytes, 51 tape blocks x aadb090910.txt, 80424 bytes, 158 tape blocks x tsese090909.txt, 13974 bytes, 28 tape blocks (4 Replies)
Discussion started by: netxus
4 Replies

6. Shell Programming and Scripting

Parse file contents in perl...

Hi, I have the file like this: #Contents of file 1 are: Dec 10 12:33:44 User1 Interface: Probe Dec 10 12:33:47 uSER1 SOME DATA Dec 10 12:33:47 user1 Interface: MSGETYPE Dec 10 12:34:48 user1 ID: 10. Dec 10 12:33:55 user1 Interface: MSGTYPE Dec 10 12:33:55 user1 Id: 9 ... (1 Reply)
Discussion started by: vanitham
1 Replies

7. Shell Programming and Scripting

Perl parse error

Hello there, I em executing the following command in a perl script to append "\0" to the end of every line in a file: ###command start my $cmd = qx{"C:\\gawk" '{print $0 "\\\0"}' C:\file.txt > C:\file_1.txt}; ###command end But i get the following error: ###error meaasge start... (2 Replies)
Discussion started by: nmattam
2 Replies

8. Programming

Perl parse string

Hi Perl Guys I have another perl question I have the following code that i have written Getopt::Long::config(qw( permute bundling )); my $OPT = {}; GetOptions($OPT, qw( ver=s help|h )) or die "options parsing failed"; This will allow the user to do something like... (4 Replies)
Discussion started by: ab52
4 Replies

9. Shell Programming and Scripting

Perl :: to parse the data from a string.

Hi folks, I have a line in log from which I need to parse few data. Jul 6 00:05:58 dg01aipagnfe01p %FWSM-3-106011: Deny inbound (No xlate) From the above... I need to parse the %FWSM-3-106011: substring. Another example Jul 13 00:08:55 dq01aipaynas01p %FWSM-6-302010: 2 in use, 1661... (3 Replies)
Discussion started by: scriptscript
3 Replies

10. Shell Programming and Scripting

Perl to parse

The below code works great to parse out a file if the input is in the attached SNP format ">". perl -ne 'next if $.==1; while(/\t*NC_(\d+)\.\S+g\.(\d+)()>()/g){printf("%d\t%d\t%d\t%s\t%s\n",$1,$2,$2,$3,$4,$5)}' out_position.txt > out_parse.txt My question is if there is another format in... (10 Replies)
Discussion started by: cmccabe
10 Replies

LEARN ABOUT OSF1

syslog.auth

syslog.auth(4)						     Kernel Interfaces Manual						    syslog.auth(4)

NAME

       syslog.auth -  authorization file for accepting remote syslog messages

SYNOPSIS

       # format:  Each fully qualified host name on a separate line hostname.domain_name

DESCRIPTION

       The /etc/syslog.auth file specifies which remote hosts are allowed to forward syslog messages to the local host.  For the sake of security,
       only messages coming from remote hosts listed in the local /etc/syslog.auth file will be logged by the syslogd daemon.

       If the /etc/syslog.auth file does not exist, then messages coming from any host will be accepted.

       Each remote host name should appear in a separate line in /etc/syslog.auth. A line started with the # character is considered as a  comment
       and is thus ignored.

       A  host	name  must be a complete domain name such as trout.zk3.dec.com. If a domain host name is given, it must either appear in the local
       /etc/hosts file or be able to be resolved by the local name server (BIND).

       Note that a host name can have at most as many characters as defined by the  MAXHOSTNAMELEN constant in <sys/param.h>, although	each  line
       in the /etc/syslog.auth file can have up to 512 characters.

       The /etc/syslog.auth file must be owned by root and has a permission of 0600.

       To invoke a new version of the /etc/syslog.auth file, run the following command (as the super user) to initialize the  syslogd daemon: kill
       -HUP `cat /var/run/syslog.pid`

EXAMPLES

       The  following  example	provides  a  typical  authorization  file:  #  format:	 Each  fully  qualified  host  name  on  a  separate  line
       c3poid.rvo.dec.com r2d2id.ckt.dec.com

FILES

       Location of the authorization file.

RELATED INFORMATION

       Commands: syslogd(8), syslog(1)

       System Administration delim off

																    syslog.auth(4)
All times are GMT -4. The time now is 09:38 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy