From: Koncept <user@...>
Date: 2004-02-28T15:19:48+09:00
Subject: (noob) need help parsing Apache log file


Being very new to Ruby, I want to be able to write a small script to
open my Apache access_log file and remove any lines that contain (\.exe
| \.ida) from the source file. I managed to figure out how to get this
information and log it to a new file, but I would really appreciate an
example of how to read and remove from one file. I am the kind of
person who learns best watching others.


This is what I wrote to parse the file. Any revisions, hints, hacks,
etc would also be very much appreciated.

src = '/var/log/httpd/access_log'
arr = IO.readlines(src)
len = arr.length
lw = 73
msEvil = Array.new
div = '--'

arr.each do |line|
   msEvil.push line if line  =~ /(\.exe| \.ida)/
end   

# Generate report
puts ('Report for: ' + Time.new.to_s).center(lw)
puts (div * 20).center(lw)
puts
puts 'Total lines:'.ljust(lw/2)  + len.to_s.rjust(lw/2)
puts 'Total Window exploits:'.ljust(lw/2)  +
msEvil.length.to_s.rjust(lw/2)

# log to text file
f = File.new("codeRed.txt", "w+")

msEvil.each do |line|
   f.puts line
end

f.close

-- 
Koncept << 
"Contrary to popular belief, the most dangerous animal is not the lion or 
tiger or even the elephant. The most dangerous animal is a shark riding 
on an elephant, just trampling and eating everything they see." - Jack Handey