It's not the loop structure, it's the variable. You're setting $i to every element of @newips, but printing $_. Either change the foreach to use $_, like so:

foreach (@newips) {
[download]

print OUTFILE $i if ...
[download]

HTH

open (LOG, "$fw_logfile") or die and mail_error($!);
open (OUTFILE, "+>>$outfile") or die and mail_error($!);
 
my $seen = 0;
 
while(<LOG>){
    foreach my $i (@newips){
        unless($seen == 500){
            print OUTFILE if (/\;drop;[^"]*$i/) && $seen++;
        }
    }
    $seen = 0;
}
[download]

my %seen;
 
while(<LOG>){
  foreach my $i (@newips){
    print OUTFILE if /\;drop;[^"]*$i/ && ++$seen{$i} <= 500;
  }
}
[download]

ysth,

Yeah that's what I was thinking ;-)

Your's and arden's code (from his second response) where the only two that I could get to work. I like the simplicity of your's, but arden's seems to run faster.

I guess this was a bit more tricky then I though. Thank god for perlmonks. I appreciate the help. -Dru

Your's and arden's code (from his second response) where the only two that I could get to work. I like the simplicity of your's, but arden's seems to run faster.

Maybe faster. But arden's code, like yours and all the others except ysth's, have a major flaw: they will skip the first (matching) field of your log file!

If you decide to use arden's solution, change $newIPseen{$i}++ to ++$newIPseen{$i}

dave

If the performance isn't good enough, you can probably increase it a fair amount by doing something like this (untested):

my %seen;
my %newip_res;

for my $ip (@newips) {
   $seen{$ip} = 0;
   $newip_res{$ip} = qr/;drop;[^"]*$ip/;
}

while(<LOG>){
  foreach my $ip (@newip) {
    ++$seen{$ip}, print OUTFILE if $seen{$ip} != 500 && /$newip_res{$i
+p}/;
  }
}
[download]

If there are more than a very few lines that don't have ";drop;" in them, also put a  next unless /;drop;/; just before the foreach.

Put $seen = 0; inside the while loop but outside of the foreach.

Update: Although I'd probably do something clsoer to

while(<LOG>){
  foreach my $i (@newips){
    if (/\;drop;[^"]*$i/) {
      print OUTFILE for 1 .. 500;
    }
  }
}
[download]

(Untested)

open (LOG, "$fw_logfile") or die and mail_error($!);
open (OUTFILE, "+>>$outfile") or die and mail_error($!);

my %newIPseen;

foreach my $i ( @newips ) {
    $newIPseen{$i} = 0;
}

while (<LOG>) {
    foreach $i ( keys( %newIPseen ) ){
        unless ( $newIPseen{$i} == 500 ) {
            print OUTFILE if (/\;drop;[^"]*$i/) && $newIPseen{$i}++;
        }
    }
}
[download]

Now, if you load the hash %newIPseen in the first place instead of the array @newips, you can get rid of the first foreach loop.

TMTOWTDI, this way with a slice:

open (LOG, "$fw_logfile") or die and mail_error($!);
open (OUTFILE, "+>>$outfile") or die and mail_error($!);
 
my $seen = 0;
 
while(<LOG>){
  foreach my $i (@newips[0..499]){
    print OUTFILE if (/\;drop;[^"]*$i/) && $seen++;
  }
}
[download]