Q: Analyse data and provide a report - Arrays?

[Troll]

You just saved me some more stress John. Thanks !
This (\w+)\s+(\d+) did the trick.

Can you pls elaborate on the difference between including stuff in brackets
or not?
Is it always in brackets except for SPACE searches?

 

[John Bokma]

Looks like I had some typos there but after correcting them it's still a no
go
/^(\w+) (\s+)/;
was changed to
/^(\w+)(\s+)(\S+)(\s+)(\S+)/;
# looking for word(s), 1 or more spaces, non-space(s), space(s),
non-space(s)


Still get the same output tho:
#output section
TCP = 6 # all is correct here
Use of uninitialized value in concatenation (.) or string at... # error
time - this refers to the 2nd print statement
RecvQ = # this is blank

What am I missing?

post a valid line.

 

[Ga Mu]

OK, I had some luck getting the first value incremented but no more.

Version which works:
*****************
if (/tcp/) {
my($Proto)=
/^(\w+)/;
$Protos{$Proto}++;
}
print "TCP = $Protos{'tcp'}\n";

#output section
TCP = 6 # all is correct here


Version which does not work:
**********************
if (/tcp/) {
my($Proto, $RecvQ)=
/^(\w+) (\s+)/;

The above re says find and extract a word into $Proto, find some
whitepsace and ignore it, then find more whitepsace and extract it into
$RecvQ. Do you mean to use an uypper-case S, meaning find non-whitepsace..?

$Protos{$Proto}++;
$RecvQs{$RecvQ)++;
}
print "TCP = $Protos{'tcp'}\n";
print "RecvQ = $RecvQs{'0'}\n";

#output section
TCP = 6 # all is correct here
Use of uninitialized value in concatenation (.) or string at... # error
time - this refers to the 2nd print statement
RecvQ = # this is blank

I have tried reading the second parameter as a (\s+) and as a (\d+) with no
luck. If you run netstat you will probably see that all items in the RecvQ
column are 0.
What have I done wrong now?

If you are trying to parse this:

Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 redhat:ssh winxp:1099 ESTABLISHED

how about this:

my ($proto,$rxQ,$txQ,$l_addr,$r_addr,$state) =
/^(\w+) (\d+) (\d+) (\S+) (\S+) (\w+)/;

which says (with whitespace in between each):

find a word and extract into $proto,
find a number and extract into $rxQ,
ditto for $txQ,
find NON-whitespace and extract into $l_addr,
ditto for $r_addr,
find a word and extract into $state.

Use \S+ for the addresses because they contain numbers, letters, and a
colon. Neither \w nor \d would match these.

Can a number of whitespaces be represented by:
/^(\w+) (\s+)/; # this is a word followed by some spaces followed by a
string
or is the above only ONE whitespace?

\s (lower-case) DOES NOT mean a string, it means whitespace.
\S (upper-case) means non-whitespace.

If you have access to "The Camel Book" by ORA, try reading the section
on pattern matching. It's clear you're not getting how to construct a
meaningful regular expression.

 

[Ga Mu]

If you are trying to parse this:

Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 redhat:ssh winxp:1099 ESTABLISHED

how about this:

my ($proto,$rxQ,$txQ,$l_addr,$r_addr,$state) =
/^(\w+) (\d+) (\d+) (\S+) (\S+) (\w+)/;

WHOOPS!

That re should have been:

/^(\w+) +(\d+) +(\d+) +(\S+) +(\S+) +(\w+)/

I just tested it and it works (my Linux box is back up).

Alternatively, you could use "\s+" instead of " +". The former means
one or more whitespace characters (space, tab, newline) , the latter (I
think) means find one or more space characters only (no tab or newline).

 

[Troll]

Greg,
Your last bit made me laugh cause it is exactly how I feel. Still need a lot
of work to understand regexes.
But thanks to the last posts from yourself and John and 2 links I found,
this is much clearer now.

My apologies to both of you for being such a pain

 

[Troll]

Mine was failing somewhere on the 4th parameter search ie. the first (\S+)
but that's because I was trying to do:
print "Dells = $LocalAddresses{'Dell'}\n;
whereas there was no value of Dell being passed anywhere - there was only
Dell:smtp and Dell:32769...DOH...


Also, what's the purpose of having something like this at the beginning of
the script:
my (%protos,%rxQs,%txQs,%l_addrs,%r_addrs,%states)
cause when I remarked it with # there was no diff to the way the script
runs.

 

[John Bokma]

Will do - thanks.
I came across the
use strict
before [looking at other ppls script examples] but never got the chance to
read up on it yet.

On a TO DO list now...

put it on *top* of the list. Speaking of top: don't top post and snip
things no longer relevant.

 

[Troll]

Sorry. I tried to improve the visibility a bit as the thread was scrolling
but I see you point.
A NG etiquette refresher needed...
Will keep things in order now and *snip* [what does that stand for?] them
when necessary

Will do - thanks.
I came across the
use strict
before [looking at other ppls script examples] but never got the chance to
read up on it yet.

On a TO DO list now...

put it on *top* of the list. Speaking of top: don't top post and snip
things no longer relevant.

 

[John Bokma]

Sorry. I tried to improve the visibility a bit as the thread was scrolling
but I see you point.
A NG etiquette refresher needed...
Will keep things in order now and *snip* [what does that stand for?] them
when necessary

cut. It is quite common when a large part is removed to state what was
removed, e.g.:

[cut perl example]

or

[snip perl example]

Sometimes <> is used instead of []. Or even ...

Most newsreaders provide scrolling by pressing the space bar. Reading a
top post and scrolling down to understand to what it is referring (and
back up and down etc) is always harder than reading bottom down. Most
postings fit on a screen after careful cutting.

 

[Troll]

John and Greg,
Thanks for the help today [again].

I'm sure to have some more Qs tomorrow but right now I need to rewrite the
code from my laptop to an external Solaris box. This will also mean my
variable definions will change. This little task will take me some time
especially that the vi editor I have to use is a less friendly version than
the one which comes with my RH9. I then need to test the code on the
external system so I don't see myself posting anymore today until same time
tomorrow.

Cheers,
T

Sorry. I tried to improve the visibility a bit as the thread was scrolling
but I see you point.
A NG etiquette refresher needed...
Will keep things in order now and *snip* [what does that stand for?] them
when necessary

cut. It is quite common when a large part is removed to state what was
removed, e.g.:

[cut perl example]

or

[snip perl example]

Sometimes <> is used instead of []. Or even ...

Most newsreaders provide scrolling by pressing the space bar. Reading a
top post and scrolling down to understand to what it is referring (and
back up and down etc) is always harder than reading bottom down. Most
postings fit on a screen after careful cutting.

 

[Troll]

Back again...
I have to say that I'm now in possession of a mostly working script - thanks
to the both of you and some Google links.

How can I get the total number of items that has been passed here?
$UDP6LocalAddresses{$UDP6LocalAddress}++;

John and Greg,
Thanks for the help today [again].

I'm sure to have some more Qs tomorrow but right now I need to rewrite the
code from my laptop to an external Solaris box. This will also mean my
variable definions will change. This little task will take me some time
especially that the vi editor I have to use is a less friendly version than
the one which comes with my RH9. I then need to test the code on the
external system so I don't see myself posting anymore today until same time
tomorrow.

Cheers,
T

Sorry. I tried to improve the visibility a bit as the thread was scrolling
but I see you point.
A NG etiquette refresher needed...
Will keep things in order now and *snip* [what does that stand for?] them
when necessary

cut. It is quite common when a large part is removed to state what was
removed, e.g.:

[cut perl example]

or

[snip perl example]

Sometimes <> is used instead of []. Or even ...

Most newsreaders provide scrolling by pressing the space bar. Reading a
top post and scrolling down to understand to what it is referring (and
back up and down etc) is always harder than reading bottom down. Most
postings fit on a screen after careful cutting.

 

[John Bokma]

Back again...
I have to say that I'm now in possession of a mostly working script - thanks
to the both of you and some Google links.

How can I get the total number of items that has been passed here?
$UDP6LocalAddresses{$UDP6LocalAddress}++;

print "$UDP6LocalAddresses{$UDP6LocalAddress}\n";

or do you mean all?

There are two ways: summing all hash values or keeping an additional
counter. The latter means: before your loop:

my $total_count = 0;

and after each $UDP6LocalAddresses{$UDP6LocalAddress}++; do

$total_count++;

 

[Troll]

Yeah, I was trying this but kept on getting a Global parameter error of some sort:
Global symbol "" requires explicit package name

If I use the total_count method it unfortunately counts my section headings as well
[I ended up simplifying the section searches a bit]

 

[John Bokma]

Yeah, I was trying this but kept on getting a Global parameter error of some sort:

Global symbol "" requires explicit package name

If I use the total_count method it unfortunately counts my section headings as well
[I ended up simplifying the section searches a bit]

my $sum = 0;
foreach my $value (values %UDP6LocalAddresses) {

$sum += $value;
}

 

[Troll]

Yeah, I was trying this but kept on getting a Global parameter error of some sort:
Global symbol "" requires explicit package name

If I use the total_count method it unfortunately counts my section headings as well
[I ended up simplifying the section searches a bit]

print "$UDP6LocalAddresses{$UDP6LocalAddress}\n";

or do you mean all?

There are two ways: summing all hash values or keeping an additional
counter. The latter means: before your loop:

my $total_count = 0;

and after each $UDP6LocalAddresses{$UDP6LocalAddress}++; do

$total_count++;

OK, I fixed it.
It ain't the most pretty of solutions but it works.

if (/UDP: IPv6/../^$/) {
my($UDP6LocalAddress)=
/^\s+(\S+)/;
$UDP6LocalAddresses{$UDP6LocalAddress}++;
if (/^$/ || /UDP: IPv6/ || /Local Address/ || /-------/) {
#do nothing
} else {
$AddressCount++;
}
}


The following is now totally obsolete but I might leave it in anyway - maybe I'll sort this out later when I'll do some more reading?:
my($UDP6LocalAddress)=
/^\s+(\S+)/;
$UDP6LocalAddresses{$UDP6LocalAddress}++;

 

[Troll]

Thanks John - will give it a try.

Yeah, I was trying this but kept on getting a Global parameter error of some sort:

Global symbol "" requires explicit package name

If I use the total_count method it unfortunately counts my section headings as well
[I ended up simplifying the section searches a bit]

my $sum = 0;
foreach my $value (values %UDP6LocalAddresses) {

$sum += $value;
}