Thanks, this helped out. I hadn't thought of trying to use strings for this, I will give that a shot.<br>
<br>
I removed the TYPE field from the regex thinking that might have been causing a problem and forgot to add it back to my regex.<br><br><div><span class="gmail_quote">On 12/27/05, <b class="gmail_sendername">Kent Johnson</b>
<<a href="mailto:kent37@tds.net">kent37@tds.net</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">Danny Yoo wrote:<br>
>>Dec 18 10:04:45 dragon logger: TCPWRAP: SERVICE=sshd@::ffff:<a href="http://192.168.0.1">192.168.0.1</a><br>>>,TYPE=ALL_DENY,HOST_ADDRESS=::ffff:<a href="http://195.145.94.75">195.145.94.75</a>,HOST_INFO=::ffff:
<br>>><a href="http://195.145.94.75">195.145.94.75</a>,HOST_NAME=unknown,USER_NAME=unknown,OTHERINFO=<br>><br>><br>> Hi Will,<br>><br>> Observation: the output above looks comma delimited, at least the stuff
<br>> after the 'TCPWRAP:' part.<br>><br>><br>>>self.twist_fail_re =<br>>>rc('SERVICE=\S*\sHOST_ADDRESS=\S*\sHOST_INFO=\S*\sHOST_NAME=\S*\sUSER_NAME=\S*\s')<br>><br>><br>> The line given as example doesn't appear to have whitespace in the places
<br>> that the regular expression expects. It does contain commas as delimiters<br>> between the key/value pairs encoded in the line.<br><br>Expanding on Danny's comment...<br><br>\S*\s matches any amount of non-whitespace followed by one whitespace.
<br>This doesn't match your sample. It looks like you want to match<br>non-comma followed by comma. For example this will match the first field:<br>SERVICE=[^,]*,<br><br>Presumably you will want to pull out the value of the field so enclose
<br>it in parenthesis to make a group:<br><br>SERVICE=([^,]*),<br><br>Another thing I notice about your regex is it doesn't include all the<br>fields in the sample, for example TYPE. If the fields are always the<br>same you can just include them in your regex. If they vary you can try
<br>to make the regex skip them, use a different regex for each field, or<br>try Danny's approach of using str.split() to break apart the data.<br><br>The Regex Demo program that comes with Python is handy for creating and
<br>testing regexes. Look in C:\Python24\Tools\Scripts\redemo.py or the<br>equivalent.<br><br>Kent<br><br>_______________________________________________<br>Tutor maillist - <a href="mailto:Tutor@python.org">Tutor@python.org
</a><br><a href="http://mail.python.org/mailman/listinfo/tutor">http://mail.python.org/mailman/listinfo/tutor</a><br></blockquote></div><br>