my @REGEXPS = ( "^\w{3} [ :0-9]{11} [._[:alnum:]-]+ pppd\[[0-9]+\]: (sent|rcvd) \[LCP EchoReq id=[[:alnum:]]+ magic=[ [:alnum:]]+\]$", "^\w{3} [ :0-9]{11} [._[:alnum:]-]+ ssh\(pam_[[:alnum:]]+\)\[[0-9]+\]: session opened for user [[:alnum:]-]+ by \(uid=[0-9]+\)$", ); my @KEEP = (); foreach my $line ( @SYSLOG ) { my $match = 0; foreach my $r ( @REGEXPS ) { if ( $line =~ /$r/) { $match = 1; } } if (! $match ) { push @KEEP, $line; } }