Regex Over Multiple Lines -- Perl

0.o · 01-26-2012, 07:02 PM

I am trying to match the following data over multiple lines:

Code:

Jan 21 22:38:09 MSIDCB01DC HEALTH: HMNOTIFY: Link State Propagation (Sensor MSIABC01EIS): Severity: recovery: s2p2_s2p1 is Normal
s1p2_s1p1 is Normal
Jan 21 22:38:56 MSIDCB01DC HEALTH: HMNOTIFY: Link State Propagation (Sensor MSIABC02EIS): Severity: recovery: s2p1_s2p2 is Normal
s1p2_s1p1 is Normal

I need to pull the name of the sensor out and also the interface states and interface names. I have no issues pulling that info off of the first line, but I am unable to pull it from the second line. I am using perl. Any assistnace would be appreciated.

Thanks!

anomie · 01-27-2012, 10:02 AM

Just trying to understand:

You wish to match across multiple lines? (There's a regex modifier - 's' - that can help with this.)
Or would it be sufficient to match one line at a time for printing / pushing onto an array?

Cedrik · 01-27-2012, 10:09 AM

How do you get the lines ?

Code:

perl -ne 'do {
  /Sensor\s(.*)\).*\s(.*)\sis\s(.*)/;
  print "Sensor: $1\n", "Interface: $2\n", "Status: $3\n";
} if /Sensor/' file

0.o · 01-28-2012, 06:06 PM

Quote:

Originally Posted by Cedrik

How do you get the lines ?

Code:

perl -ne 'do {
  /Sensor\s(.*)\).*\s(.*)\sis\s(.*)/;
  print "Sensor: $1\n", "Interface: $2\n", "Status: $3\n";
} if /Sensor/' file

I am getting the lines via a syslog message. The script is executed via syslog-ng so I am receiving the message line-by-line.

Cedrik · 01-28-2012, 06:17 PM

Could you post your script and show where it should be improved ?
I don't get the issue with multiple lines if you get the message line by line :/

0.o · 01-30-2012, 11:54 AM

Quote:

Originally Posted by Cedrik

Could you post your script and show where it should be improved ?
I don't get the issue with multiple lines if you get the message line by line :/

Here's the part of the script that is in question. I am receiving these messages line-by-line. So, I can't do a nested if like below because the second line will not match the first if. I need to match across both lines to pull out the Sensor hostname, interface names and also the state of the interface across both lines. I have tried using /n to match the new line and even .* to match the newline and have been unsuccessful.

Code:

#Jan 21 22:38:09 MSIABC01DC HEALTH: HMNOTIFY: Link State Propagation (Sensor MISABC01EIS): Severity: recovery: s2p2_s2p1 is Normal 
#s1p2_s1p1 is Normal
if(/link state propagation \(Sensor (MSI[a-z]{3}[0-9]{2,3}[a-z]*)\).* (s[0-9]p[0-9]_s[0-9]p[0-9]) is (normal|triggered)/smi)
{
        my $hostname=$1;
        my @interface;
        push(@interface,$2);
        push(@interface,$3);
        if(/(^s[0-9]p[0-9]_s[0-9]p[0-9]) is (normal|triggered)/i)
        {
                push(@interface,$1);
                push(@interface,$2);
        }
        print @interface;    
}

Cedrik · 01-30-2012, 12:08 PM

Why not use different ifs for each line ?

Code:

#Jan 21 22:38:09 MSIABC01DC HEALTH: HMNOTIFY: Link State Propagation (Sensor MISABC01EIS): Severity: recovery: s2p2_s2p1 is Normal 
#s1p2_s1p1 is Normal

my @interface;

if(/link state propagation \(Sensor (MSI[a-z]{3}[0-9]{2,3}[a-z]*)\).* (s[0-9]p[0-9]_s[0-9]p[0-9]) is (normal|triggered)/smi)
{
        my $hostname=$1;
        
        push(@interface,$2);
        push(@interface,$3);
}
if(/(^s[0-9]p[0-9]_s[0-9]p[0-9]) is (normal|triggered)/i)
{
        push(@interface,$1);
        push(@interface,$2);
}
print @interface;

0.o · 01-30-2012, 12:33 PM

Quote:

Originally Posted by Cedrik

Why not use different ifs for each line ?

Code:

#Jan 21 22:38:09 MSIABC01DC HEALTH: HMNOTIFY: Link State Propagation (Sensor MISABC01EIS): Severity: recovery: s2p2_s2p1 is Normal 
#s1p2_s1p1 is Normal

my @interface;

if(/link state propagation \(Sensor (MSI[a-z]{3}[0-9]{2,3}[a-z]*)\).* (s[0-9]p[0-9]_s[0-9]p[0-9]) is (normal|triggered)/smi)
{
        my $hostname=$1;
        
        push(@interface,$2);
        push(@interface,$3);
}
if(/(^s[0-9]p[0-9]_s[0-9]p[0-9]) is (normal|triggered)/i)
{
        push(@interface,$1);
        push(@interface,$2);
}
print @interface;

That is a possibility, but it would be much cleaner to use regex to match across both lines.

Cedrik · 01-30-2012, 12:38 PM

Why cleaner ? For coding style, personally I prefer separate ifs, but YMMV

Another solution is to store first line in a variable, append the second line, then use multiline matching, but I don't see the point, better to process lines as soon as they arrive imho