Should I read the whole logfile to an array and then go back?

Log files tend to get very large, so reading the whole lot might cause problems.

The following assumes that the relevant lines will be grouped together and only keeps 4 lines in memory at a time; change the constant if you need more.

It then runs the regex against the concatenation of the current 4 lines and outputs the relevant fields when a match is found.

It works on a test file consisting of a few dozen repetitions of your posted data with most of the sets of lines modified not to match; beyond that testing depends upon the nature of your data:

perl -nwle" if(push( @s, $_ ) > 4 ){ shift @s } qq[@s]=~m[.+from (\S+)
+.+identity ('[^']+').+verification failed]s and print qq[$1:$2]" junk
+.dat

[download]

Remember to change/adjust/escape the "s & 's for *nix.

With the rise and rise of 'Social' network sites: 'Computers are making people easier to use everyday'
Examine what is said, not who speaks -- Silence betokens consent -- Love the truth but pardon error.
"Science is about questioning the status quo. Questioning authority". I knew I was on the right track :)
In the absence of evidence, opinion is indistinguishable from prejudice.

In reply to Re: Parse multiline logfile by BrowserUk
in thread Parse multiline logfile by chris2013

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.