I am relatively new to perl and would like some assistance. I have been at this for quite some time. What I am looking for is a way to extract certain information from a log file. I have attached a sample of the log file and the desired output as well as the code I have thus far

=======================================

Request: 10.122.11.235 - - [Tue Mar  9 22:27:46 2004] "GET http://sbc2
+.login.dcn.yahoo.com/config/login?.redir_from=PROFILES?&.tries=1&.src
+=jpg&.last=&promo=&.intl=us&.bypass=&.partner=&.chkP=Y&.done=http://j
+pager.yahoo.com/jpager/pager2.shtml&login=loginc&passwd=PASS HTTP/1.0
+" 200 566
Handler: proxy-server
Error: mod_security: pausing [http://sbc2.login.dcn.yahoo.com/config/l
+ogin?.redir_from=PROFILES?&.tries=1&.src=jpg&.last=&p
+romo=&.intl=us&.bypass=&.partner=&.chkP=Y&.done=h
+ttp://jpager.yahoo.com/jpager/pager2.shtml&login=loginc&passw
+d=PASS] for 50000 ms
----------------------------------------
GET http://sbc2.login.dcn.yahoo.com/config/login?.redir_from=PROFILES?
+&.tries=1&.src=jpg&.last=&promo=&.intl=us&.bypass=&.partner=&.chkP=Y&
+.done=http://jpager.yahoo.com/jpager/pager2.shtml&login=loginc&passwd
+=PASS HTTP/1.0
Accept: */*
Accept-Language: en
Connection: Keep-Alive
mod_security-message: Access denied with code 200. Pattern match "pass
+wd=" at THE_REQUEST.
mod_security-action: 200

HTTP/1.0 200 OK
Connection: close

[download]

SAMPLE OUTPUT I AM LOOKING FOR:

Attacker’s address 10.122.11.235
Username:loginc,Password:exodus:PASS

[download]

I have been extracting data from the log file for example, the Top 10 results of mod_security-message header. I am looking for something similar. Thanks

open (LOGFILE2,"audit_log") || die "  Error opening log file $logFile.
+\n";
   #printf "<pre>\n";
   while (<LOGFILE2>) {


if (/mod_security-message[:](.*)\./)
{

$MOD_SEC{$1}++

}



 close (LOGFILE);



   #--------------------------------------#
   #  Output the number of hits per file  #
   #--------------------------------------#

   print "TOP $NUM_RECS_TO_PRINT PATTERN MATCH:\n";
   print "-----------------------------\n\n";
   $count=1;
   foreach my $modsec (sort {$MOD_SEC{$b} <=> $MOD_SEC{$a}} (keys(%MOD
+_SEC))) {
      last if ($count > $NUM_RECS_TO_PRINT);
      print "$count\t$modsec= $MOD_SEC{$modsec}  \n";
    
      $count++;
   }
   print "\n\n";

[download]

In reply to Brute Force Attacks by AbCraig

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.