TalkPHP
 
 
Account Login
Latest Articles
» The basic usage of PHPTAL, a XML/XHTML template library for PHP
» Vulnerable methods and the areas they are commonly trusted in.
» Simple way to protect a form from bot
» The Basics On: How Session Stealing Works
» How to keep your forms from double posting data
IRC Channel
IRC Speech Bubble Join the friendly bunch on IRC...
(#TalkPHP on Freenode)

...Also available via a web interface.

See this thread for information on the TalkPHP Free Hugs Initiative™. Subject to availability.
Associates
Associates
CSS Tutorials
Reply
 
LinkBack Thread Tools Search this Thread Display Modes
Old 06-19-2008, 09:30 AM   #1 (permalink)
The Contributor
 
quantumkangaroo's Avatar
 
Join Date: Feb 2008
Location: Pretoria, South Africa
Posts: 42
Thanks: 1
quantumkangaroo is an unknown quantity at this point
Default Samba log parser

Hey guys

Im looking to write a script to parse my samba logs and insert the data into a database. Problem is the text file samba writes, records arent placed on one line so it could go from 2 to 3 to even 5 lines per record. Each record is different so a similar exploding point isnt possible. Please give me some ideas of how one would seperate this data.

Example Records:

[2008/04/10 08:09:44, 0] lib/util_sock.c:get_peer_addr(1229)
getpeername failed. Error was Transport endpoint is not connected
[2008/04/30 11:51:36, 0] smbd/server.c:main(847)
smbd version 3.0.23d-6-1083-SUSE-SL10.2 started.
Copyright Andrew Tridgell and the Samba Team 1992-2006

Any input is appreciated :)
__________________
virtueCart v1.0.5 developed by WebDevSA

Send a message via MSN to quantumkangaroo Send a message via Skype™ to quantumkangaroo
quantumkangaroo is offline  
Reply With Quote
Old 06-19-2008, 10:20 PM   #2 (permalink)
La Vida es Sueño
Advanced Programmer Top Contributor 
 
Wildhoney's Avatar
 
Join Date: Sep 2007
Location: Oldham
Posts: 2,280
Thanks: 90
Wildhoney is on a distinguished road
Default

The only problem I see with my code is if a square bracket appears in the error description somewhere. If not then it will work fine. If, however, it does appear in the description, I'm not sure a way around it. You could possibly narrow it down by checking if the square bracket is at the beginning of a new line.

PHP Code:
$szSamba = <<<TP

[2008/04/10 08:09:44, 0] lib/util_sock.c:get_peer_addr(1229)
getpeername failed. Error was Transport endpoint is not connected
[2008/04/30 11:51:36, 0] smbd/server.c:main(847)
smbd version 3.0.23d-6-1083-SUSE-SL10.2 started.
Copyright Andrew Tridgell and the Samba Team 1992-2006
[2008/04/10 08:09:44, 0] lib/util_sock.c:get_peer_addr(1229)
getpeername failed. Error was Transport endpoint is not connected
[2008/04/30 11:51:36, 0] smbd/server.c:main(847)
smbd version 3.0.23d-6-1083-SUSE-SL10.2 started.
Copyright Andrew Tridgell and the Samba Team 1992-2006

TP;

preg_match_all('~\[(.+?)\]([^\[]+)~ix'$szSamba$aMatches);
print_r($aMatches); 
__________________
The man who comes back through the Door in the Wall will never be quite the same as the man who went out.
Send a message via AIM to Wildhoney Send a message via MSN to Wildhoney Send a message via Yahoo to Wildhoney
Wildhoney is offline  
Reply With Quote
The Following User Says Thank You to Wildhoney For This Useful Post:
quantumkangaroo (06-20-2008)
Old 06-20-2008, 11:24 AM   #3 (permalink)
The Contributor
 
quantumkangaroo's Avatar
 
Join Date: Feb 2008
Location: Pretoria, South Africa
Posts: 42
Thanks: 1
quantumkangaroo is an unknown quantity at this point
Default

Going from multiple lines of a record to 1 line makes my life so much easier thanks Wildhoney :)
__________________
virtueCart v1.0.5 developed by WebDevSA

Send a message via MSN to quantumkangaroo Send a message via Skype™ to quantumkangaroo
quantumkangaroo is offline  
Reply With Quote
Reply



Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On


All times are GMT. The time now is 12:54 AM.

 
     

Powered by vBulletin® Version 3.6.8
Copyright ©2000 - 2013, Jelsoft Enterprises Ltd.
Search Engine Optimization by vBSEO 3.1.0
Inactive Reminders By Icora Web Design