in reply to virus log parser
Which prints:use strict; use Parse::RecDescent; use Data::Dumper; my $grammar = q{ viruslog: message(s) { %{$return} = map {@{$_}} (@{$item[1]}); } message: /^(\w+):\s+ (.*)/x { $return = [lc($1), $2]; } }; my $parser = new Parse::RecDescent $grammar or die "Invalid grammar"; foreach (split /---+/, join '', <DATA>) { my $record = $parser->viruslog($_); print Dumper($record) if defined $record; } __DATA__ From: pminich@foo.com To: esquared@foofoo.com File: value.scr Action: The uncleanable file is deleted. Virus: WORM_KLEZ.H ---------------------------------- Date: 06/30/2002 00:01:21 From: mef@mememe.com To: inet@microsoft.com File: Nr.pif Action: The uncleanable file is deleted. Virus: WORM_KLEZ.H ----------------------------------
Like the solutions above, this will give you a hash for each record to make it easy to insert into a database. But, you'll notice that I do almost no work to achieve the result. There are really only 2 lines of Perl (the codeblocks in the grammar) that actually do anything here (aside from the split)! It also will handle any new message types if they are ever added to your log.$VAR1 = { 'file' => 'value.scr', 'virus' => 'WORM_KLEZ.H', 'to' => 'esquared@foofoo.com', 'from' => 'pminich@foo.com', 'action' => 'The uncleanable file is deleted.' }; $VAR1 = { 'date' => '06/30/2002 00:01:21', 'file' => 'Nr.pif', 'virus' => 'WORM_KLEZ.H', 'to' => 'inet@microsoft.com', 'from' => 'mef@mememe.com', 'action' => 'The uncleanable file is deleted.' };
|
---|