... my %lookfor; # will look like this at the end # %lookfor = ( # 192.168.254.1 => { # first => '03/13/03 16:44:56', # last => '03/13/03 16:59:30', # count => 12, # bytes => 1234 # }, # 192.168.254.2 => { # .... # } # ); # while () { if (/(.*?) kernel Temporarily blocking host (.*)/) { $lookfor{$2}{first} = $1; } elsif (/(.*?) firewalld.*? deny in eth0 (\d+) (\w+) (\d+) (\d+) ([\d\.]+) (\d+) (\d+) (\w+) (.*)/) { if (exists $lookfor{$6}) { $lookfor{$6}{count} += 1; $lookfor{$6}{last} = $1; $lookfor{$6}{bytes} += $7; # or whichever field is bytes # keep track of other info of interest } # else ignore the uninteresting deny lines } # else ingore lines we don't care about at all } printf "%15s %6s %18s %18s %s\n", qw/ ip count first last bytes /; foreach my $badguy (keys %lookfor) { printf "%15s %6d %18s %18s %d\n", $badguy, $lookfor{$badguy}{count}, $lookfor{$badguy}{first}, $lookfor{$badguy}{last}, $lookfor{$badguy}{bytes}; }