Thank you for all your efforts, it seems we've almost got it working. But there is one thing that bothers me now: Script works correct, but only once. It can detect one event and even handle it correctly, but if second event occurs, it doubles ( it writes a second copy of the squid.conf to the same file) squd.conf and grey.list files, and squid quits with an error. The weird thing that filehandles are open for a writing and not for appending, it means that any content should be rewritten with the new one. So I think the problem is in @cfg array, it's getting doubled somehow. 
#!/usr/bin/perl
# Squid reconfiguration script rev: 0.91
#
use File::Tail;
sub ban {
open( CFG, "<", "/etc/squid/squid.conf" );
    while ( <CFG> ) {
    push @cfg, $_;
    }
close(CFG);
#my $line = shift;
#my ($proxy) = $line =~ m| - \S+/(proxy_\S+)|;
#my @cutoff = grep /$proxy/, @cfg;

my @cutoff = grep /proxy_/,@_;
s/ROUNDROBIN_PARENT\///g for @cutoff;
@cutoff = grep /@cutoff/,@cfg;


open( GREY, ">>", "/etc/squid/all.grey" );
if (@cutoff) {
            print GREY @cutoff;
            print GREY "10\n";
}
close (GREY);

print "Banned parrent: @cutoff\n";
print " Strings with parrent in conf: @cutoff\n";

open( EXC, ">", "/etc/squid/squid.conf" );
my %dels = map { $_ => 1 } @cutoff;
@cfg = grep !$dels{$_}, @cfg;
print EXC @cfg;
close (EXC);
@args = ("/etc/init.d/squid", "reload");
system(@args) == 0 or die "system @args failed: $?" ;
}

my $name = "/var/log/squid/access.log";
my $ref=tie *FH,"File::Tail",(name=>$name, maxinterval=>1);
     while (<FH>) {
        m|/sorry/| && ban (split ' ',$_);

}

[download]

In reply to Re^8: Real time log parser by kazak
in thread Real time log parser by kazak

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.