kevin r wrote:
> Rob,
>
> I believe that you are correct in that there is an alternative answer.
> Without posting a long script, here is the premise:
>
> while logfile {
> if (certain conditions are met)
> push @portArray, $_ ## pushes certain elements of the $_ into array,
> protocol and port number
>
> The array will look like the following:
>
> 80 TCP
> 443 TCP
> 137 UDP
> 80 TCP
> 80 TCP
> 25 TCP
> .
> .
> .
>
> This becomes a very long list. From here I would sort and then
> sequentially step through the array. If the current line does not
> look like the last line the print the last line and the number of
> times it was counted. The output looks as follows:
>
> TCP 80 - 25
> TCP 443 - 32
> TCP 25 - 837
> UDP 137 - 23
>
> That logic was based on the sort function. Any help would be great,
> I have a couple of ideas to make it faster that I am going to try.
>
> Kevin
>
>
>
>
>> From: "Rob Dixon" <[EMAIL PROTECTED]>
>> To: [EMAIL PROTECTED]
>> Subject: Re: Sorting Help!!!
>> Date: Thu, 30 Jan 2003 18:34:11 -0000
>>
>> Kevin R wrote:
>>> Hello,
>>>
>>> I am having problems with the sort routine. I am writing a script
>>> that parses very large firewall logs. At one point during the
>>> script I end up with a very large array containing all of the
>>> destination udp and tcp port numbers. This array can be up being
>>> over 100,000 entries. I am trying to sort with the following:
>>>
>>> @sortedPortArray = sort(@portArray);
>>>
>>> It works, but I could crawl up under my desk and take a nap before
>>> it will finish. Is there a faster way to sort? Thank you in
>>> advance for your help.
>>
>> Perhaps the answer lies in not sorting the data at all :-?
>>
>> If you explain the problem that you're solving with a sort, perhaps
>> we can suggest an alternative.
>>
>> Cheers,
>>
>> Rob
If you are just reading and generating counts for ports on either UDP or
TCP, then you should be able to use a hash with the port as key and either
tie in [u]dp and [t]cp, so you would have t80 or u80 as the key and then
sort of the key. Should be able to so this on the fly and quite quickly.
Wags ;)
**********************************************************
This message contains information that is confidential
and proprietary to FedEx Freight or its affiliates.
It is intended only for the recipient named and for
the express purpose(s) described therein.
Any other use is prohibited.
****************************************************************
--
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
