Re: Cisco Log Files: broken REGEX

[chunlou]

It doesn't hurt to split up your regex for readability.

$_='Aug 21 19:00:36 [1.1.1.3.200.125] 410381: Aug 21 23:00:35 UTC: %SE
+C-6-IPACCESSLOGP: list 101 denied tcp 10.161.24.153(3988) -> 10.158.2
+4.10(135), 1 packet';

/
([A-Z][a-z]+\s+\d+\s+\d+\:\d+\:\d+)     # Aug 21 19:00:36
\s+
(\[\d+\.\d+\.\d+\.\d+\.\d+\.\d+\])      # [1.1.1.3.200.125]
\s+
(\d+:)                                  # 410381:
\s+ 
([A-Z][a-z]+\s+\d+\s+\d+\:\d+\:\d+)     # Aug 21 23:00:35
\s+
([A-Z]{3}:)                             # UTC:
\s+
(\%SEC-\d-\w+?:)                        # %SEC-6-IPACCESSLOGP:
\s+
(list\s\d+\s.*?)                        # list 101 denied tcp
\s+
(\d+\.\d+\.\d+\.\d+\(\d+\))             # 10.161.24.153(3988)
\s+->\s
(\d+\.\d+\.\d+\.\d+\(\d+\))             # 10.158.24.10(135)
\s*,\s+
(.*)                                    # 1 packet
/x;

print "$1\n$2\n$3\n$4\n$5\n$6\n$7\n$8\n$9\n$10";

__END__
Aug 21 19:00:36
[1.1.1.3.200.125]
410381:
Aug 21 23:00:35
UTC:
%SEC-6-IPACCESSLOGP:
list 101 denied tcp
10.161.24.153(3988)
10.158.24.10(135)
1 packet