E
erik
I am trying to chop up some netscreen firewall logs where I just want
certain fields. In perl, I am doing a "cut" and picking the fields that
I want. The problem is, silly netscreens insert spaces in thier service
name at will. For example it might have:
start_time="2005-11-08 service=https proto=6 src src_port=3873
dst_port=443 src-xlated ip=x.x.x.x
(notice there is no space in the service name, it is just https)
start_time="2005-11-08 service=Network Time proto=17 dst=x.x.x.x
src_port=123 dst_port=123 src-xlated
(notice the space between Network and Time.)
If my cut is space deliminated, the space in the service name throws me
off by 1 field of course. How can I regex a data flow that is always
changing? I am stuck...
Now I can do a "find and replace" for ALL the possible space
deliminated service names, but that has a high Level of Effort. Any
ideas?
certain fields. In perl, I am doing a "cut" and picking the fields that
I want. The problem is, silly netscreens insert spaces in thier service
name at will. For example it might have:
start_time="2005-11-08 service=https proto=6 src src_port=3873
dst_port=443 src-xlated ip=x.x.x.x
(notice there is no space in the service name, it is just https)
start_time="2005-11-08 service=Network Time proto=17 dst=x.x.x.x
src_port=123 dst_port=123 src-xlated
(notice the space between Network and Time.)
If my cut is space deliminated, the space in the service name throws me
off by 1 field of course. How can I regex a data flow that is always
changing? I am stuck...
Now I can do a "find and replace" for ALL the possible space
deliminated service names, but that has a high Level of Effort. Any
ideas?