Your's and arden's code (from his second response) where the only two that I could get to work. I like the simplicity of your's, but arden's seems to run faster.

Maybe faster. But arden's code, like yours and all the others except ysth's, have a major flaw: they will skip the first (matching) field of your log file!

If you decide to use arden's solution, change $newIPseen{$i}++ to ++$newIPseen{$i}

dave

Well done Not_a_Number++, I totally missed that (of course, since I didn't test it, no wonder!).

To prove that in perl you can do things more than one way, this would also work:
( print OUTFILE if (/\;drop;[^"]*$i/) ) && $newIPseen{$i}++;
    although I do prefer using ++$newIPseen{$i};.

update: mark this day my friends, I was wrong!^*



^*not a day has gone by when arden wasn't wrong about something

The postfix "if" is called a statement modifier becauses it modifies a statement; you can't use it within an expression like that. The above gets a syntax error.

my %seen;
my %newip_res;

for my $ip (@newips) {
   $seen{$ip} = 0;
   $newip_res{$ip} = qr/;drop;[^"]*$ip/;
}

while(<LOG>){
  foreach my $ip (@newip) {
    ++$seen{$ip}, print OUTFILE if $seen{$ip} != 500 && /$newip_res{$i
+p}/;
  }
}
[download]