Uhh ... errr ... it's pushing a string comprised of the tab separated values $message, $firewall and $service onto the array reference $user ... Uhhh ... err ...

$match_flag = 0;

foreach $control (@control_array)
{
    if ($control eq $user)
    {
        $match_flag = 1;
        last;
    }
}

if ($match_flag == 0)
{
    ## We have not seen this user yet put an entry in the control_arra
+y...
    push (@control_array, $user);
}

push(@$user,"$ent_date\t$message\t$firewall\t$service");
}
[download]

The push at the end is adding a string to an arrayref called $user. The string consists of a tab-separated list of some unknown scalars: $ent_date, $message, $firewall and $service. Nobody can tell you what's in these variables because you haven't told us anything about them:(

If you doubt derby(++), they you can look for youself with this code:

use Data::Dumper; $Data::Dumper::Useqq = 1;
...
            print Dumper 'Before the push', $user;
            push(@$user,"$ent_date\t$message\t$firewall\t$service");
            print Dumper 'After the push', $user;
[download]

That code, which I understand isn't yours, is pretty funky. It creates a named array through a symbolic reference for each distinct $user you see. It would be much cleaner and better to use a hash.

That whole chunk of code can be replaced with:

push @{$control_hash{$user}},
    "$ent_date\t$message\t$firewall\t$service";
[download]

Not necessarily a symbolic reference; it could be an overloaded object.

The hash discards order, which may be important.

Unless I'm missing something - it doesn't have to be an overloaded obj or a symbolic ref. It could be just a non-explicit (DWIM) deref.

use strict;
use warnings;
use Data::Dumper;

my $user = [ 'foo','bar' ];
push( @$user,'baz');
print Dumper $user;
[download]

grep

1)Gain XP 2)??? 3)Profit