$ip = ""; $port = ""; $usr = ""; $pass = ""; $status = ""; $frequency = 0; #Given this is a user/pass attempt honeypot logger, I will use a wide character to reduce the possibility of stopping #the WEKA CSV loader from functioning by using smileyface as seperators. while(my $lines = ){ if($lines =~ /New connection/){ ($ip, $port) = (split /[\[\]\s:()]+/, $lines)[7,8]; } if($lines =~ /login attempt/){#and the ip of the new connection if($lines =~ /$ip/){ ($usr, $pass, $status) = (split /[\s:\[\]\/]+/, $lines)[-3,-2,-1]; if($lines =~/$ip/ && $lines =~/$usr/ && $lines =~ /$pass/){ $frequency++ } if($ip && $port && $usr && $pass && $status ne ""){ print FILE2 join "$seperator",($port, $status, $frequency, $end); print FILE2 "\n"; } } }