Perl Pattern Matching-- Newbie

V

Vandana

I am trying to write a perl program for analysing Sys Logs generated by
Unix, Windows and Cisco firewalls.

This Logs come into a centralised database and there are like 100s of
messages per hour. I am trying to write a script which will seperate
messages which are critical for the System Administrator and analyse it.

For this purpose I am starting with a initial database where I collected
messages which are critical. Now I am trying to identify the messages as
them come and decide whether I have seen them earlier or not.

Example:
My Error message looks something like this:

39212:Tue Dec 30 10:11:55 2003: (1030) - Windows cannot
query for the list of Group Policy objects. A message that describes the
reason for this was previously logged by the policy engine.";

and I want to check whether this message has
"query for the list of Group Policy objects"

Please can you suggest what is the best way to do something like this in
Perl.
 
G

Gunnar Hjalmarsson

Vandana said:
I am trying to write a perl program for analysing Sys Logs
generated by Unix, Windows and Cisco firewalls.

Please can you suggest what is the best way to do something like
this in Perl.

I'd suggest some Perl code.
 
G

gnari

Vandana said:
This Logs come into a centralised database and there are like 100s of
messages per hour. I am trying to write a script which will seperate
messages which are critical for the System Administrator and analyse it.

remember: do not try to match critical messages.
find the lines that are NOT critical, and assume that all other
ARE critical.

keep a database of non-critical patterns, and have an easy way
for the Administrator to add to that database.


gnari
 
S

sidsharma

Example:
My Error message looks something like this:

39212:Tue Dec 30 10:11:55 2003: (1030) - Windows cannot
query for the list of Group Policy objects. A message that describes the
reason for this was previously logged by the policy engine.";

and I want to check whether this message has
"query for the list of Group Policy objects"

Please can you suggest what is the best way to do something like this in
Perl.

$s = "39212:Tue Dec 30 10:11:55 2003: (1030) - Windows cannot
query for the list of Group Policy objects. A message that describes the
reason for this was previously logged by the policy engine.";
$t = "query for the list of Group Policy objects";
if ($s=~m/$t/) { # Whatever you want to do with it.;}

Use the match operator m// I suppose....
 
T

Tad McClellan

Vandana said:
My Error message looks something like this:

39212:Tue Dec 30 10:11:55 2003: (1030) - Windows cannot
query for the list of Group Policy objects. A message that describes the
reason for this was previously logged by the policy engine.";

and I want to check whether this message has
"query for the list of Group Policy objects"

Please can you suggest what is the best way to do something like this in
Perl.


if ( index($msg, 'query for the list of Group Policy objects' >= 0 ) {
print "matched\n";
}
else {
print "No match\n";
}
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Members online

No members online now.

Forum statistics

Threads
473,744
Messages
2,569,484
Members
44,904
Latest member
HealthyVisionsCBDPrice

Latest Threads

Top