As rjt says, there’s nothing wrong with using a straight regex approach. However, in the spirit of TMTOWTDI, here’s a different approach which begins by dividing the line into word-like chunks:

#! perl
use strict;
use warnings;

my $string = 'May 20 18:57:27 1.23.25.5 %ASA-6-106100 a6 [local4.info]
+ access-list Myaccess-Block permitted tcp outside/10.31.0.9(3803) -> 
+inside/10.29.10.91(4127) hit-cnt 1 300-second interval [0xa178b29d, 0
+x0]';
   @ARGV   = split /\s+/, $string;
printf "Time:                  %s\n", join ' ', (shift, shift, shift);
printf "Source Firewall:       %s\n", shift;
shift for 1 .. 4;
printf "Source ACL:            %s\n", shift;
printf "Action:                %s\n", shift;
printf "Protocol:              %s\n", shift;
shift =~ m! (.+) / (.+) \( (\d+) \) !x;
printf "Source Interface:      %s\n", $1;
printf "Source IP:             %s\n", $2;
printf "Source Port:           %s\n", $3;
shift;
shift =~ m! (.+) / (.+) \( (\d+) \) !x;
printf "Destination Interface: %s\n", $1;
printf "Destination IP:        %s\n", $2;
printf "Destination Port:      %s\n", $3;
shift for 1 .. 4;
shift =~ m! \[ (.+) , !x;
printf "Rule:                  %s\n", $1;

[download]

Output:

12:39 >perl 626_SoPW.pl
Time:                  May 20 18:57:27
Source Firewall:       1.23.25.5
Source ACL:            Myaccess-Block
Action:                permitted
Protocol:              tcp
Source Interface:      outside
Source IP:             10.31.0.9
Source Port:           3803
Destination Interface: inside
Destination IP:        10.29.10.91
Destination Port:      4127
Rule:                  0xa178b29d

12:44 >

[download]

Hope that helps,

Athanasius <°(((>< contra mundum Iustus alius egestas vitae, eros Piratica,

In reply to Re: A better way to parse this with regexes? Pix ASA logs by Athanasius
in thread A better way to parse this with regexes? Pix ASA logs by symgryph

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.