Hi Matt,
Had a look at this script but it just confused me a bit.
So I wrote this that does what you want but works in a slightly diffrent way
(end result is the same though)
#!/usr/bin/perl
use warnings;
use strict;
# First we make a list of what we want to find
my @List;
open CULIST, "CULIST3.txt" or die $!;
while (<CULIST>) {
chomp; # Strip the trailing linefeeds
push ( @List, $_ );
}
# Now we loop over the log and select the lines that contain stuff from our
list.
my @Intresting_Lines;
open SEPTEMBER, "log_netscreen_sep" or die $!;
while (<SEPTEMBER>) {
chomp; # Strip the trailing linefeeds
foreach my $intrest ( @List ) {
push ( @Intresting_Lines, $_ ) if ( $_ =~ /$intrest/ );
}
}
foreach my $Line ( @Intresting_Lines ) {
print $Line . "\n";
}
I hope this helps a bit there is comments and stuff there.
On 11/9/06, mlist <[EMAIL PROTECTED]> wrote:
I hope this is an easy one (I have a feeling it is).
I'm trying to parse through a single, large firewall log file. I need
to run through a file to get the firewall name and push the associated
data to it's own log file. This is what I have so far:
#!/usr/bin/perl
use warnings;
use strict;
open CULIST, "/root/syslog_stuff/CULIST3.txt" or die $!;
open SEPTEMBER, "/var/log/log_netscreen_sep" or die $!;
while (<CULIST>) {
my $culist = $_;
print $culist;
open CU_OUTPUT, ">> /root/syslog_stuff/monthly_logs/sep/$culist" or
die $!;
while (<SEPTEMBER>) {
my @cuseptember = $_;
my @breakup = grep(/$culist/, @cuseptember);
print CU_OUTPUT "@breakup";
print @breakup;
}
}
The problem is that when I print @breakup (to either the file or stdin)
nothing shows up. An example of the contents of the two files are:
CULIST3.txt:
SUN9-GT:
SUNM-25:
SVWM-25:
TECM-GT:
TELM-25:
TEPM-25:
TEP-NWEST:
TEP-SPDWY:
TEP-WHTMTN:
TEXM-GT:
TOWER-GT:
/var/log/log_netscreen_sep:
Sep 1 00:00:01 192.168.207.10 BVAM-GT: NetScreen device_id=BVAM-GT [No
Name]system-notification-00257(traffic): start_time="2006-09-01
01:42:02" duration=62 policy_id=12 service=syslog proto=17 src
zone=Trust dst zone=Untrust action=Tunnel (CSS) sent=400 rcvd=0
Sep 1 00:00:04 192.168.107.249 TPF1-GT: NetScreen device_id=TPF1-GT
[No Name]system-notification-00257(traffic): start_time="2006-09-01
00:26:48" duration=20 policy_id=0 service=tcp/port:7800 proto=6 src
zone=Trust dst zone=Untrust action=Permit sent=620 rcvd=0
Sep 1 00:00:07 192.168.125.10 MPLSYS: NetScreen device_id=MPLSYS [No
Name]system-notification-00257(traffic): start_time="2006-09-01
01:42:11" duration=0 policy_id=320001 service=udp/port:33436 proto=17
Can anybody shed some light on this for me? I'd appreciate it greatly.
Matt
--
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
<http://learn.perl.org/> <http://learn.perl.org/first-response>
