Linux Kernel Logs

Regular Expression to parse KERNEL style logs

sub parse_line {
    my $line;
    my ($month,$day,$date,$action,$proto,$source,$sourceport,$target,$targetport);
    ($month,$day,$action,$proto,$source,$sourceport,$target,$targetport) =
        /(\w+) +(\d+) \d\d:\d\d:\d\d \w+ kernel: Packet log: \w+ (\w+) \w+ PROTO=(\d+) (\d+\.\d+\.\d+.\d+):(\d+) (\d+\.\d+\.\d+.\d+):(\d+)/i;
#        Month  day      HH:MM:SS hostname                chain act. if      protocol     sourceip     s.port     targetip       t.port
    $month=$Months{uc($month)};
    $proto=getprotobyname($proto) unless $proto=~/\d/;
    if ( $month && $day && $source && $sourceport && $target && $targetport && $proto && ($action ne 'ACCEPT')  ) {
        $line= "$year-$month-$day\t$author\t%%COUNT%%\t$source\t$sourceport\t$target\t$targetport\t$proto\n";
    }
    return $line;
};