Hey Monks,

I'm in need of some assistance once again. I have a log file in this format (*note: ip's have been changed to protect the guilty): 
1;30Nov2001;17:08:25;192.148.14.2;log;accept;;hme0;outbound;udp;192.14
+8.84.4;24.248.34.99;domain-udp;1103;43;85;;;;;;;;;;;;;;;
2;30Nov2001;17:08:25;192.148.14.2;log;drop;;hme0;inbound;tcp;43.228.94
+.254;192.148.11.47;netbios-ssn;18803;48;89;;;;;;;;;;;;;;;
3;30Nov2001;17:08:26;192.148.14.2;log;drop;;hme0;inbound;tcp;45.93.220
+.223;192.148.24.139;auth;1323;40;89;;;;;;;;;;;;;;;
4;30Nov2001;17:08:26;192.148.14.2;log;drop;;hme0;inbound;tcp;45.93.220
+.223;192.148.24.139;auth;1323;40;89;;;;;;;;;;;;;;;
5;30Nov2001;17:08:26;192.148.14.2;log;accept;;qfe2;inbound;tcp;192.148
+.84.144;24.248.34.97;http;4719;44;85;;;;;;;;;;;;;;;
6;30Nov2001;17:08:26;192.148.14.2;log;accept;;hme0;outbound;tcp;192.14
+8.84.144;24.248.34.97;http;4719;44;85;;;;;;;;;;;;;;;
7;30Nov2001;17:08:26;192.148.14.2;log;accept;;qfe2;inbound;tcp;192.148
+.84.144;24.248.34.97;http;4721;44;85;;;;;;;;;;;;;;;
8;30Nov2001;17:08:26;192.148.14.2;log;accept;;hme0;outbound;tcp;192.14
+8.84.144;24.248.34.97;http;4721;44;85;;;;;;;;;;;;;;;
8;30Nov2001;17:08:26;192.148.14.2;log;accept;;hme0;outbound;tcp;192.14
+8.84.144;24.248.34.97;http;4721;44;85;;;;;;;;;;;;;;;
9;30Nov2001;17:08:26;192.148.14.2;log;accept;;qfe2;inbound;tcp;192.148
+.27.154;205.188.145.185;http;4394;44;85;;;;;;;;;;;;;;;
10;30Nov2001;17:08:26;192.148.14.2;log;accept;;hme0;outbound;tcp;192.1
+48.27.154;205.188.145.185;http;4394;44;85;;;;;;;;;;;;;;;
11;30Nov2001;17:08:26;192.148.14.2;log;accept;;qfe2;inbound;tcp;192.14
+8.27.154;205.188.145.185;http;4397;44;85;;;;;;;;;;;;;;;
12;30Nov2001;17:08:26;192.148.14.2;log;accept;;hme0;outbound;tcp;192.1
+48.27.154;205.188.145.185;http;4397;44;85;;;;;;;;;;;;;;;

[download]
What I am trying to do is check and see if an ip address along with a service (http) remains constant for a certain number of entries (we'll say 5 for this example). I need the script to be able to determine if ANY service shows up 5 times with the ip address given. Here is what I've come up with: 
#!/usr/bin/perl -w 
use strict;
                         
my $log = './log';                                                    
+    
my ($count1, $dst, $service, %count, %hash);
                     
my $ip = '24.248.36.97'; 
    
open (LOG, $log) or die "Can't open $log: $!"; 
while (<LOG>){ 
                     
   ($dst, $service) = (split /;/)[11, 12];
   $count1++ if ($dst =~ /$ip/);
 
   %hash = (service => $service); 
   foreach my $key ($hash{service}){
     $count{$key}++;   
   }                   
}                      
  
foreach my $key1 (keys %count){ 
 print "There are at least 5 occurences of $key1 and $ip.\n" if ($coun
+t{$key1} >= 5 && $count1 >= 5);
}

[download]
This works, but when I run it with -w and strict, I get the following output: 
Use of uninitialized value in pattern match (m//) at ./misconfig.pl li
+ne 13, <LOG> line 36.
Use of uninitialized value in hash element at ./misconfig.pl line 17, 
+<LOG> line 36.
There are at least 5 occurences of http and 24.248.36.97.

[download]

I have a few questions if somebody would be most gratefull to help me out:
Thanks in advance,
Dru

In reply to Best way to pick apart log file. by dru145

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.