From: Koji Arai <JCA02266@...>
Date: 2003-10-26T07:32:47+09:00
Subject: [ruby-list:38664] Re: $B6u9T$GJL$l$?%G!<%?$+$iFCDj$NJ8;z$r4^$`%G!<%?$r:o=|$7$?$$(B

新井です。

In message "[ruby-list:38662] 空行で別れたデータから 特定の文字を含むデータを削除したい"
  on 26 Oct 2003 05:32:38 +0900,
  あさひ <okou@kochi.email.ne.jp> wrote:

> #!/usr/local/bin/python
> import re
> e = [   'BAD-TRAFFIC loopback traffic',
>         'ICMP PING CyberKit 2.2 Windows',
>         'MS-SQL',
>         'WEB-CGI count.cgi access',
>         'WEB-FRONTPAGE /_vti_bin/ access',
>         'WEB-IIS',    
>         'WEB-MISC robots.txt access',
>         'SCAN Proxy (8080) attempt',
>         'SCAN SOCKS Proxy attempt',
>         'SCAN Squid Proxy attempt',
>         'SCAN UPnP service discover attempt',
>   ]
> p = re.compile('|'.join(e))
> s = open('/var/log/snort/alert').read()
> r = s.split('\n\n')
> for x in r:
>     if  p.search(x):
>         pass
>     else:
>         print x + '\n'

そのまま書き換えてみました。

#!/usr/local/bin/ruby

e = [   'BAD-TRAFFIC loopback traffic',
        'ICMP PING CyberKit 2.2 Windows',
        'MS-SQL',
        'WEB-CGI count.cgi access',
        'WEB-FRONTPAGE /_vti_bin/ access',
        'WEB-IIS',
        'WEB-MISC robots.txt access',
        'SCAN Proxy (8080) attempt',
        'SCAN SOCKS Proxy attempt',
        'SCAN Squid Proxy attempt',
        'SCAN UPnP service discover attempt',
  ].collect {|v| Regexp.quote(v)}
p = Regexp.compile(e.join('|'))
s = open('/var/log/snort/alert').read()
r = s.split(/\n\n/)
for x in r
    if  p.match(x)
    else
        print x + "\n"
    end
end

少し、Rubyらしく(というより好み?)しました。この程度じゃそん
な差は出ませんね。

#!/usr/local/bin/ruby

e = [   'BAD-TRAFFIC loopback traffic',
        'ICMP PING CyberKit 2.2 Windows',
        'MS-SQL',
        'WEB-CGI count.cgi access',
        'WEB-FRONTPAGE /_vti_bin/ access',
        'WEB-IIS',
        'WEB-MISC robots.txt access',
        'SCAN Proxy (8080) attempt',
        'SCAN SOCKS Proxy attempt',
        'SCAN Squid Proxy attempt',
        'SCAN UPnP service discover attempt',
  ].collect {|v| Regexp.quote(v)}
p = Regexp.compile(e.join('|'))

s = File.read('/var/log/snort/alert')
s.split(/\n\n/).each {|x|
  puts x if p !~ x
}

--
新井康司 (Koji Arai)