=-> perl -c fwanalysis
elseif should be elsif at fwanalysis line 197.
syntax error at fwanalysis line 197, near ") {"
syntax error at fwanalysis line 209, near "}"
fwanalysis had compilation errors.
[download]

You should fix that problem. And the other compliation error that will appear after you fix that one. Please, test your code before showing it to us.

That said, don't make external calls to date like that, try Date::Format, or strftime from the POSIX module (use POSIX qw(strftime); my $today = strftime('%d%b%y',localtime);). Doing that should make your code more portable.

Also, Mail::Send is probably a better thing to use then sendmail directly (since some systems don't have sendmail, of course.) That may also make your code more portable.

I would also strongly reccommend you indent your subroutines consistently. (Personally I prefer that all subroutines be indented, but I can see a good reason to not do that, in some cases.)

update: Looking at your code with more detail I see this:

my $ip1 = $ips[0][0];
my $times = $ips[0][1];
whois($ip1);
evidence($ip1,$times);
 
 
# Second ip
 
my $ip2 = $ips[1][0];
my $times2 = $ips[1][1];
whois($ip2);
evidence($ip2,$times2);
 
# Third ip
 
my $ip3 = $ips[2][0];
my $times3 = $ips[2][1];
whois($ip3);
evidence($ip3,$times3);
 
# ...
[download]

This is MUCH better written as a loop. For example:

foreach my $i (0..14) {
  my($ip,$times) = @{$ip[$i]};
  whois($ip);
  evidence($ip,$times);
}
[download]

And that's still terribly written, too. You should try to make your subroutines be independent of each other -- avoid global variables.

update2: (... pass things as arguments to subroutines instead, or use OO if that is more appropriate.) Another potential problem I see is this:

  if ($_ =~ $ip){
[download]

The problem with this is that regex metacharacters will be interperated in the IP address, so the .s in the IP address will match any character. For example, if the IP address were 1.2.4.8 then lines of the logfile for the IP address 162.4.83.1 would match that. You might be better of using something like $_ =~ /\Q$ip\E/, or index($_, $ip) != -1.

On this issue of your regex for extracting the domain, etc from the email, note that there are many valid emails that your regex won't match (search for a node on e-mail validation to see why). Consider using Mail::Address instead of a regex.