Use a do...for loop. 

my $calog = "/var/log/ca/ca.log.1";
my @newlist;
@calines = get_file($calog);
@newlist = which_lines(@calines);
print "@newlist";
#############################
# Important part
#############################
sub which_lines {
for (@_) {
/\.512/ && do { push(@new1, $_);};
}
for (@new1) {
!/renewed|revoked/ && do { push(@new, $_); };
}
return @new ;
}

sub get_file {
        my $file = shift;
        local *IN;
        open (IN, "<$file") or die "Cannot read '$file': $!";
                if (wantarray) {
                return <IN>;
                } else {
                return join '', <IN>;
        }
}

[download]

This gives me the following output: 

Sep 14 14:00:04 nt-na-pk NA(Domain-ca): Certificate came 'tuser.512' a
+dded to database.
Sep 14 14:48:20 nt-na-pk NA(Domain-ca): Certificate came 'psmith.512' 
+added to database.

[download]

It could be tidied up some, but you should get the idea....

Update:

After I posted this I re-read the problem, and this obviously doesn't work. You can change the /\.512/ to /\.512|\.2048/, and that takes care of the first problem I noticed.

Now, you say users that have not been removed or revoked? Does this need to go chronologically? If not, parse the remaining good lines for your user names, and then re-search the original array for lines where they have been revoked or renewed.

In the example of tuser.512, the renew line is directly after the good line. So in the case of chronological order, your logic flow could work: Get "added" line -> search next line for revoked|removed for same user.

~Hammy

In reply to Re: Need help with Parsing Unique Users out of Syslog by HamNRye
in thread Need help with Parsing Unique Users out of Syslog by dru145

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.