I removed the TYPE field from the regex thinking that might have been causing a problem and forgot to add it back to my regex.
On 12/27/05, Kent Johnson
<[EMAIL PROTECTED]> wrote:
Danny Yoo wrote:
>>Dec 18 10:04:45 dragon logger: TCPWRAP: SERVICE=sshd@::ffff:192.168.0.1
>>,TYPE=ALL_DENY,HOST_ADDRESS=::ffff:195.145.94.75,HOST_INFO=::ffff:
>>195.145.94.75,HOST_NAME=unknown,USER_NAME=unknown,OTHERINFO=
>
>
> Hi Will,
>
> Observation: the output above looks comma delimited, at least the stuff
> after the 'TCPWRAP:' part.
>
>
>>self.twist_fail_re =
>>rc('SERVICE=\S*\sHOST_ADDRESS=\S*\sHOST_INFO=\S*\sHOST_NAME=\S*\sUSER_NAME=\S*\s')
>
>
> The line given as example doesn't appear to have whitespace in the places
> that the regular _expression_ expects. It does contain commas as delimiters
> between the key/value pairs encoded in the line.
Expanding on Danny's comment...
\S*\s matches any amount of non-whitespace followed by one whitespace.
This doesn't match your sample. It looks like you want to match
non-comma followed by comma. For example this will match the first field:
SERVICE=[^,]*,
Presumably you will want to pull out the value of the field so enclose
it in parenthesis to make a group:
SERVICE=([^,]*),
Another thing I notice about your regex is it doesn't include all the
fields in the sample, for example TYPE. If the fields are always the
same you can just include them in your regex. If they vary you can try
to make the regex skip them, use a different regex for each field, or
try Danny's approach of using str.split() to break apart the data.
The Regex Demo program that comes with Python is handy for creating and
testing regexes. Look in C:\Python24\Tools\Scripts\redemo.py or the
equivalent.
Kent
_______________________________________________
Tutor maillist - Tutor@python.org
http://mail.python.org/mailman/listinfo/tutor
_______________________________________________ Tutor maillist - Tutor@python.org http://mail.python.org/mailman/listinfo/tutor
