The ip part comes before, so I should use:
if(/\[(\d+\.\d+\.\d+\.\d+)\].+reject=550/)
instead of
if($_ =~ /reject=550/) {
if($_ =~ /\[(\d+\.\d+\.\d+\.\d+)\]/) {
etc...
Much more compact.
Nice one David!
> -----Original Message-----
> From: david [mailto:[EMAIL PROTECTED]]
> Sent: 19 September 2002 18:36
> To: [EMAIL PROTECTED]
> Subject: Re: regex and ip address extraction
>
>
> Griggs Rob wrote:
>
> > Hi Guys,
> >
> > The code below extracts an ip address from the
> /var/log/maillog file in
> > the event of the line containing the words "reject=550". It
> works fine,
> > but is there a way of shortening that regular expression?
> >
> > open(LOG,"/var/log/maillog");
> >
> > while(<LOG>) {
> > chomp;
> > if($_ =~ /reject=550/) {
> >
> > if($_ =~ /\[(\d+\.\d+\.\d+\.\d+)\]/) {
> > $address = $1;
> >
> > # Add address to firewall filtering here
>
> does the ip part come after or before the reject=550 part? will the
> reject=550 part always separeted by the ip part with at lease
> one byte? try
> something like:
>
> if(/reject=550.+(\[(\d+\.\d+\.\d+\.\d+)\])/){
> $address = $1;
> }
>
> assume reject=550 comes first, separate by at least one byte,
> follow by the
> ip portion. i think you get the idea.
>
> david
>
> --
> To unsubscribe, e-mail: [EMAIL PROTECTED]
> For additional commands, e-mail: [EMAIL PROTECTED]
>
--
Email Disclaimer can be viewed at:
http://www.netscalibur.co.uk/email.html
--
--
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
