Fellow Monks,

I completed the below script and have it working fine and dandy, but it is 527 lines long :-(

I explain in the comments what the script is doing. To see an example of the logsum file that is referenced in the $reportfile variable and a little more history on this post, then check out the node Automating Firewall Log Reporting.

Instead of having to us a separate while loop, splice, and email for each ip address, is there a way that I can incorporate all this into just one loop and email to make this script shorter and more efficient? I appreciate any help.

-Dru 
#!/usr/bin/perl -w
use strict;

# Set variables
my $today=`date +%d%b%y`;
chomp($today);
my $reportfile = "/exported/analysis/$today.logsum";
my $topten = 0;
my $logfile = "/exported/$today.elog"; 
my @ips;
my $from_addr="Root<root\@mydomain.com>";
my $to_addr="IS Security<Security\@mydomain.com";

# Open up the fwlogsum report and store all of the top ten ip addresse
+s into the array @ips
open REPORT, "$reportfile" or die "Can't open FWLOGSUM File: $!\n";
while (<REPORT>){
  chomp;
  $topten = 1 if m!^Users/Source Addresses!;
  next unless $topten;
  push @ips, [split /\s+/] if /^(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})/;
}
close REPORT;

# Pull out the first ip address and assign it to the variable $ip
my $ip1 = qr/\b$ips[0][0]\b/o;
my @fwlog1;

# Open up the firewall log file and match the ip address and store the
+ results into the array @fwlog1
open LOG, "$logfile" or die "Can't open $logfile: $!\n";
while (<LOG>){
  if ($_ =~ $ip1){
      push (@fwlog1, $_); 
 } #end if
} #end while
close LOG;

# Splice the array @fwlog1 and take only the first 15 entries to be in
+cluded in the email as "evidence"
# Also substitute any firewall ip addresses for x's for add protection
splice(@fwlog1, 15);
foreach (@fwlog1){ 
s/192\.168\.13\.2/x.x.x.x/;
s/192\.168\.2\.2/x.x.x.x/;
s/192\.168\.214\.46/x.x.x.x/;
s/192\.168\.148\.2/x.x.x.x/;
}

# Open sendmail and send Flagged Activity email to the Security Team f
+or review.
open(SENDMAIL, "|/usr/lib/sendmail -oi -t")
                      or die "Can't fork for sendmail: $!\n";

print SENDMAIL <<EOM;
From: $from_addr
To: $to_addr
Subject: Flagged Activity from $ips[0][0]
System Administrator,

Hello. I am the Network Security Manager from ACME Inc. While I was sc
+anning our firewall logs 
I discovered an ip from your registered network was trying to gain acc
+ess to APC's 
network. Could you please look into this for me and provide a reason w
+hy a computer on 
your network would be trying to gain access to our network. 

Here are the details:

Source IP Address: $ips[0][0]
Number of times: $ips[0][1]
        
Sample from the firewall logs (*note date/time are Eastern Daylight Ti
+me -4 GMT):

@fwlog1

Thank You,
Security Team
ACME Inc.

EOM
close(SENDMAIL) or warn "sendmail didn't close nicely";


# IP2
my $ip2 = qr/\b$ips[1][0]\b/o;
my @fwlog2;

--------Repeats the while loop, splice, and email 9 more times for eac
+h ip addresses-------------

[download]

In reply to Incorporating each while loop and email into one loop? by dru145

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.