On 8/9/05, Wagner, David --- Senior Programmer Analyst --- WGO
<[EMAIL PROTECTED]> wrote:
> Alex wrote:
> > Hello everyone,
> >
> > I need some help to fix a problem in mailgraph.pl script. I'm not a
> > perl programmer, so i hope to find a little help here...
> >
> > I need to translate an old code which is parsing my maillog file, into
> > new one, related to my present needs.
> >
> > The old code has worked with old vexira logging style (now
> > deprecated).... Lines in my maillog was something like:
> >
> > Aug 7 13:40:28 pharma vgatefwd[1532]: VIRUS bla bla bla
> >
> > Here comes old code:
> > elsif($prog eq 'vagatefwd') {
> > # Vexira antivirus
> > if($text =~ /^VIRUS/) {
> > event($time, 'virus');
> > }
> > }
> >
> > The new code (rewrited by me), should work with new vexira logging
> > style... lines in my maillog as following:
> >
> > Aug 7 13:40:28 pharma hook[2446]: ***** Virus (I-Worm.Netsky.Q1)
> > killed with file delete!
> >
> > Here come the new code....
> > elsif($prog eq 'hook') {
> > # Vexira antivirus
> > if($text =~ /^\([\*]+\) Virus\b/) {
> No it won't work for you. You are asking for a start of line then a
> paren followed by zero or more * then a paren, a space the the word Virus.
> You can try something like:
>
> if($text =~ /\s\*{1,}\s{1,}Virus\b/)
> where you are looing for a space followed by 1 or more *, 1 or more spaces
> then Virus.
>
> Wags ;)
> > event($time, 'virus');
> > }
> > }
> >
> > Is my new code correct? If no, how should it be?
> >
> > Regards,
> > Alex
There must be more going on here. The original regex matches at the
beginning of the line--'^VIRUS'--so everything up to the space
following the colon must be stripped before the regex in the if
conditional gets it. '$text =~ /^VIRUS/' doesn't match on 'Aug 7 blah
blah blah'. In that case, simply replacing /^VIRUS/ with /^Virus/
should work fine. or better yet:
if ( $text =~ /^virus/i ) {
I think we need to see more of the code, though, to be sure of what's going on.
HTH,
--jay
--------------------------------------------------
This email and attachment(s): [ ] blogable; [ x ] ask first; [ ]
private and confidential
daggerquill [at] gmail [dot] com
http://www.tuaw.com http://www.dpguru.com http://www.engatiki.org
--
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
<http://learn.perl.org/> <http://learn.perl.org/first-response>
