http://qs321.pair.com?node_id=285623


in reply to Cisco Log Files: broken REGEX

It doesn't hurt to split up your regex for readability.
$_='Aug 21 19:00:36 [1.1.1.3.200.125] 410381: Aug 21 23:00:35 UTC: %SE +C-6-IPACCESSLOGP: list 101 denied tcp 10.161.24.153(3988) -> 10.158.2 +4.10(135), 1 packet'; / ([A-Z][a-z]+\s+\d+\s+\d+\:\d+\:\d+) # Aug 21 19:00:36 \s+ (\[\d+\.\d+\.\d+\.\d+\.\d+\.\d+\]) # [1.1.1.3.200.125] \s+ (\d+:) # 410381: \s+ ([A-Z][a-z]+\s+\d+\s+\d+\:\d+\:\d+) # Aug 21 23:00:35 \s+ ([A-Z]{3}:) # UTC: \s+ (\%SEC-\d-\w+?:) # %SEC-6-IPACCESSLOGP: \s+ (list\s\d+\s.*?) # list 101 denied tcp \s+ (\d+\.\d+\.\d+\.\d+\(\d+\)) # 10.161.24.153(3988) \s+->\s (\d+\.\d+\.\d+\.\d+\(\d+\)) # 10.158.24.10(135) \s*,\s+ (.*) # 1 packet /x; print "$1\n$2\n$3\n$4\n$5\n$6\n$7\n$8\n$9\n$10"; __END__ Aug 21 19:00:36 [1.1.1.3.200.125] 410381: Aug 21 23:00:35 UTC: %SEC-6-IPACCESSLOGP: list 101 denied tcp 10.161.24.153(3988) 10.158.24.10(135) 1 packet