[nycbug-talk] Text parsing question

[Jesse Callaway]

On Tue, Dec 16, 2008 at 10:37 AM, maddaemon at gmail.com
<maddaemon at gmail.com>wrote:

> On Mon, Dec 15, 2008 at 8:46 PM, Jan Schaumann <jschauma at netmeister.org>
> wrote:
> > "maddaemon at gmail.com" <maddaemon at gmail.com> wrote:
> >
> >> Dec 15 05:15:56 - abc1234 tried logging in from 192.168.8.17
> >> Dec 15 05:15:56 - abc1234 tried logging in from 192.168.18.13
> >
> > Split into timestamp, line and IP.  Use a hash:
> >
> > if $line matched "abc1234 tried logging in from"
> >        if ! $line_by_ts{$timestamp}
> >                $line_by_ts{$timestamp} = $ip
> >        else
> >                if $ip != $line_by_ts{$timestamp}
> >                        # dupe with different ip
> >                else
> >                        # dupe with same ip
> >                endif
> >        endif
> > endif
> >
> > awk or perl should do.
> >
> > -Jan
>
> That looks like it might work, except for the fact that there are a
> possible 300+ user IDs that might be in the list.  Is there a way in
> this line:
>
> if $line matched "abc1234 tried logging in from"
>
> to use a variable instead of "abc1234"?
> _______________________________________________
> talk mailing list
> talk at lists.nycbug.org
> http://lists.nycbug.org/mailman/listinfo/talk
>


No, perl and awk only have limited text processing functions, it has to be
an official timestamp.

-jesse
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.nycbug.org:8443/pipermail/talk/attachments/20081216/187896d9/attachment.htm>