[Chas]

Originally Posted by kofcrazy

Thanks Charlie, I got almost everything to work. I have two more things to ask. Can you explain this line of coding

my ($ip, $ts) = $header =~ /\[(.*)\]\).*>; (.*)$/;

See the link I posted two messages ago. It links to the Perl regex beginner's guide that will explain most of that. I still struggle with regexes myself and I would have a hard time putting that regex to words that would make sense to you.

because some of the email headers differs from the email header I posted. So I need to know how this line works and its syntax so I can modify it.
For example, it couldn't find the ip and date of this email:
[snip /]

I figured as much. That's why I mentioned that in my original post. This varies from mail server to mail server and it's going to be difficult at best to nail this down to one regex. At least it would be for me

And when I run the code on the folder containing the emails, I get a lot of this:

Reading c:/2003/2003/10/1067645710.15548_35.txt... Done.
Reading c:/2003/2003/10/1067645711.15548_37.txt... Done.
Reading c:/2003/2003/10/1067645712.15548_40.txt... Done.

I like to add print statements so I can see what's going on. You can remove those if you don't want to see that output or add a verbose flag to enable/disable the print statements.

Oh I would like to extract only the last ip, or the first ip from bottom to top. In the case above it would be 200.141.45.150. Once I get this ip and the date that accompanies it, I would like to stop searching this email for any more ips. I was thinking to read starting from the end of the file and stop once it finds one ip. I'm not sure if this can be done.

Of course it can be done Try something like this when reading in the file:

Code:

foreach my $header (reverse(<MSG>)) {

It already stops once it finds the first occurance of an IP address and moves on to the next e-mail.

Thanks
Sida

No worries.

~Charlie