LITTLEBLACKDOG.COM

looking for a perl script that will watch for several known ip addresses & email when found.

this is being done whilist tailing a linux log file.

help please

Posted: Fri Aug 31, 2007 11:28 am Post subject:

This is extremely quick 'n' dirty. You will certainly need to go to town on the pattern matching, and it only prints the matches to stdout, and it never exits, but the principle is there:

("Perl" with a lower case P is spelled incorrectly to get past the braindead lameness filter.)

Code: Select all

#!/usr/bin/peerl





use strict;


use File::Tail;





my $logfile = 'test.log';


my $file = File::Tail->new(name=>$logfile, maxinterval=>5, adjustafter=>5);


while (defined(my $line=$file->read)) {


   if($line =~ m/^10\.0\.0\.5/) {


      print "$line";


   }


}

If you create the test.log file and start the script in one terminal window:

Code: Select all

[mbooth@mc ~]$ touch test.log


[mbooth@mc ~]$ ./test.pl

And then start appending to the test.log file from another terminal window:

Code: Select all

[mbooth@mc ~]$ echo "10.0.0.1" >> test.log


[mbooth@mc ~]$ echo "10.0.0.2" >> test.log


[mbooth@mc ~]$ echo "10.0.0.3" >> test.log


[mbooth@mc ~]$ echo "10.0.0.4" >> test.log


[mbooth@mc ~]$ echo "10.0.0.5" >> test.log


[mbooth@mc ~]$ echo "10.0.0.6" >> test.log

You get this output in the first window:

Code: Select all

[mbooth@mc ~]$ touch test.log


[mbooth@mc ~]$ ./test.pl


10.0.0.5

It acts like it's grepping tail -f output. Is that the sort of thing you're after?

Posted: Fri Aug 31, 2007 4:18 pm Post subject:

sweet thanks

Posted: Mon Sep 03, 2007 6:12 am Post subject:

I remember seeing a linux program that does this already I just can't remember the name of it off hand.

Posted: Mon Sep 03, 2007 5:34 pm Post subject:

that program is Tenshi & it works damn good. Thats what we ended up using.

http://www.securityfocus.com/tools/4301

Posted: Mon Sep 03, 2007 6:08 pm Post subject:

I am kind of flabbergasted here.

I don't know anything about Linux (even though, ironically, I make
a lot of money converting people to it), but I knew the answer to this.

I don't see how that was possible Undecided

Posted: Tue Sep 04, 2007 6:01 am Post subject:

TOMaxwell wrote:
I am kind of flabbergasted here.

I don't know anything about Linux (even though, ironically, I make
a lot of money converting people to it), but I knew the answer to this.

I don't see how that was possible

nice to see you with an avatar again Very Happy