Re: virus log parser

How about collecting the information, then printing the record when you get to one of the '-----' lines? (This assumes all records -- even the last one -- end with a '-----' line.)

The following code reads from __DATA__ and writes its (tab delimited) records to the screen; you would probably want to open your log file for processing (open(LF,"$logFile")), and write to a results file (open(OF,">$outputFile")).

#!/usr/bin/perl -w
use strict;

my $gCurRec;

foreach(qw(name to file action virus))
{
  $gCurRec->{$_}='';
}

while(<DATA>)
{
  $gCurRec->{name}=$1   if (/^From:\s*(.+?)\s*$/);
  $gCurRec->{to}=$1     if (/^To:\s*(.+?)\s*$/);
  $gCurRec->{file}=$1   if (/^File:\s*(.+?)\s*$/);
  $gCurRec->{action}=$1 if (/^Action:\s*(.+?)\s*$/);
  $gCurRec->{virus}=$1  if (/^Virus:\s*(.+?)\s*$/);

  if (/^-----/)
  {
    print $gCurRec->{name},"\t",
          $gCurRec->{to},"\t",
          $gCurRec->{file},"\t",
          $gCurRec->{action},"\t",
          $gCurRec->{virus},"\n";

    foreach(qw(name to file action virus))
    {
      $gCurRec->{$_}='';
    }

  }
}


__DATA__
From: pminich@foo.com
To: esquared@foofoo.com
File: value.scr
Action: The uncleanable file is deleted.
Virus: WORM_KLEZ.H
----------------------------------
Date: 06/30/2002 00:01:21
From: mef@mememe.com
To: inet@microsoft.com
File: Nr.pif
Action: The uncleanable file is deleted.
Virus: WORM_KLEZ.H
----------------------------------
[download]

Comment: One other thing I found I like is opening files with three parameters. For example, instead of:

open(OF,">$outputFile") || die;

I use:

open(OF,'>',$outputFile) || die;

I hope this helps! *Smiles*

Update:

Now that I have re-read my code, I should have made

qw(name to file action virus)

a constant so it was defined but one place, and should have made the field separator a constant as well. This would simplify changes to the code. (Not that it is critical on such a small program, but it is a good practice... well, for me at least.)

Comment on Re: virus log parser Download Code

Replies are listed 'Best First'.

Re: Re: virus log parser
by rincew (Novice) on Jul 02, 2002 at 21:56 UTC

First of all, the construct

    foreach(qw(name to file action virus))
    {
      $gCurRec->{$_}='';
    }
[download]

hash slices


    my @columns = qw(name to file action virus);
    @{ $gCurRec }{ @columns } = ('') x @columns;
[download]

this

Furthermore, why do you use a hash reference to store the data when a hash would be sufficient? (This is probably a matter of style.)

Then, I usually consider multiple repeated lines with trivial differences like

    $gCurRec->{name}=$1   if (/^From:\s*(.+?)\s*$/);
    $gCurRec->{to}=$1     if (/^To:\s*(.+?)\s*$/);
[download]


    /^(\w+):\s*(.+?)\s*$/ and $gCurRec->{$1} = $2;
[download]

So finally here is my attempt at implementing your algorithm:

#!/usr/bin/perl -w
use strict;

my %gCurRec = ();

while(<DATA>) {
  /^-+\s*$/ and do {
    print join("\t",
            map { exists $gCurRec{$_} ? $gCurRec{$_} : '' }
            qw(from to file action virus)
          ) . "\n";
    %gCurRec = ();
    next;
  };

  /^(\w+):\s*(.+?)\s*$/ and $gCurRec{lc $1} = $2;
}


__DATA__
From: pminich@foo.com
To: esquared@foofoo.com
File: value.scr
Action: The uncleanable file is deleted.
Virus: WORM_KLEZ.H
----------------------------------
Date: 06/30/2002 00:01:21
From: mef@mememe.com
To: inet@microsoft.com
File: Nr.pif
Action: The uncleanable file is deleted.
Virus: WORM_KLEZ.H
----------------------------------
[download]

[reply]
[d/l]
[select]

Re: Re: Re: virus log parser

by crazyinsomniac (Prior) on Jul 03, 2002 at 08:56 UTC

First of all, the construct foreach(qw(name to file action virus)) { $gCurRec->{$_}=''; } can be expressed very succinctly using so called hash slices, i.e. my @columns = qw(name to file action virus); @{ $gCurRec }{ @columns } = ('') x @columns;
[download]


$gCurRec = {
    map { ( $_ => "" ) }
    qw{ from to file action virus }
};
[download]

______crazyinsomniac_____________________________
Of all the things I've lost, I miss my mind the most.
perl -e "$q=$_;map({chr unpack qq;H*;,$_}split(q;;,q*H*));print;$q/$q;"

[reply]
[d/l]
[select]


The stupid question is the question not asked
	PerlMonks