use strict; use warnings; my %date_hash = ( "Jan" => "01", "Feb" => "02", "Mar" => "03", "Apr" => "04", "May" => "05", "Jun" => "06", "Aug" => "07", "Sep" => "08", "Oct" => "10", "Nov" => "11", "Dec" => "12" ); while() { #stripoff everything up through "WARNGING" #adjust the date, converting the month to it's numerical. s/.+WARNING ([A-Za-z]{3})/$date_hash{$1}/; # remove, the tags before each IP, and also convert the "/port number" to a "space" "port number" #I'm not sure about that part s/[^:]+:(\d+\.\d+\.\d+\.\d+)\/(\d+)/$1 $2:/g; print; } __DATA__ 6/13/2005 5:59:57 PM 10.1.1.2 WARNING Jun 13 2005 22:00:04: %PIX-4-106023: Deny udp src aliens:192.168.1.35/1148 dst dmz:10.10.10.32/1434 by access-group "aliens" #### 06 13 2005 22:00:04: %PIX-4-106023:192.168.1.35 1148:10.10.10.32 1434: by access-group "aliens"