[SOLVED] regexp / pcregrep odd behaviour ?

LBM · 12-05-2018, 05:39 AM

Can someone explain me what it wrong with the following regex ?
I have an string which look like this, from a logfile

Code:

Dec  4 16:59:31 server dovecot: auth-worker(4850): sql(silvia,186.251.225.186): unknown user

I then try so extract the IP like so, but it reverts the IP, and miss the last couple of chars ?

Code:

pcregrep -o1 "dovecot.+([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).+unknown user" test.log 
6.251.225.186

if I ommit, dovecot.+, it works, but I need to have this in as well.

Code:

pcregrep -o1 "([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).+unknown user" test.log 
186.251.225.186

I asume, it has something to do with the pharantheses in the string, "auth-worker(4850)" , or ?

l0f4r0 · 12-05-2018, 06:02 AM

For me it has nothing to do with parentheses. It's just because pcregrep seems greedy so your first IP digits go inside your ".+" whatever your "[0-9]{1,3}"
Try this for example and you'll see the difference:

Code:

pcregrep -o1 "dovecot.+,([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).+unknown user" test.log

LBM · 12-05-2018, 06:22 AM

Nice, that did the trick! thx man!
But what does the "," do here ?

l0f4r0 · 12-05-2018, 06:46 AM

Quote:

Originally Posted by LBM

But what does the "," do here ?

This comma is the one coming just before your IP, see:

Quote:

silvia,186.251.225.186

LBM · 12-05-2018, 06:56 AM

Ah yes, of course!

Thanks again!

It seems to be working by setting it "non-greedy" as well, by using ? instead of ,.

Code:

dovecot.+?([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).+unknown user

l0f4r0 · 12-05-2018, 07:48 AM

^Yes (because it's Perl), even better!