This makes several assumptions based soley upon the sample data provided:

Updated: Simplified 1 regex and improved another.

#! perl -slw use strict; my %log; while( <DATA> ) { my( $src, $mode, $rest ) = m' ( ^ \S+ ) \s+ - \s+ ( [^\[:]+ ) (?: \[ \d+ \] )? : \s* ( .+ $ ) 'x; ## $rest =~ s[ (?: \S+ \. ){1,4} \S+ ][****]gx; $rest =~ s[ (?: [\w-]+ \. ){1,4} [\w-]+ ][****]gx; ## $rest =~ s[ [a-z] (?= [^:]* [A-Z] [^:\s]+ \d ) [^:\s]+ $rest =~ s[ [a-z] \w+ \d : ][****]gx; ++$log{ $src }{ $mode }{$rest}; } for my $src ( sort keys %log ) { print $src; for my $mode ( sort keys %{ $log{ $src } } ) { print " $mode"; print " ($log{ $src}{ $mode }{ $_ }) $_" for sort keys %{ $log{ $src}{ $mode } }; } } __DATA__ your sample data

Produces (after update):

C:\test>junk5 infocache02 ldap_cachemgr (1) Error: Unable to refresh from profile:tls_automount_profil +e. (error=1) (1) libsldap: Status: 91 Mesg: openConnection: simple bind fa +iled - Can't connect to the LDAP server sendmail (3) **** Losing ./**** savemail panic (2) **** SYSERR(root): savemail: cannot save rejected email an +ywhere mail2-in postfix/smtpd (2) warning: ****: address not listed for **** (4) warning: ****: hostname **** verification failed: hostname + nor servname provided, or not known mail2-out ntpd (5) sendto(****): Bad file descriptor postfix/smtp (1) warning: malformed domain name in resource data of MX reco +rd for ****: (1) warning: numeric domain name in resource data of MX record + for ****: **** (1) warning: valid_hostname: empty hostname

Examine what is said, not who speaks -- Silence betokens consent -- Love the truth but pardon error.
"Science is about questioning the status quo. Questioning authority".
In the absence of evidence, opinion is indistinguishable from prejudice.
"Too many [] have been sedated by an oppressive environment of political correctness and risk aversion."

In reply to Re: adaptive syslog message parsing by BrowserUk
in thread adaptive syslog message parsing by Anonymous Monk

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":



  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.