Solved

How can i parse this string

Posted on 2004-10-19
25
197 Views
Last Modified: 2010-04-23
i have a string of

10/19/2004 12:08:03 AM - (   757) 9fe2 LOGIN "jsangel@dragonsworkshop.com" "XXXX"

id like to parse it so i get the values of

check for LOGIN in multible lines of a text file

when line is found return values of

Login_Date = "10/19/2004"
Login_Time = "12:08:03 AM "
Login_Email = "jsangel@dragonsworkshop.com"
Login_PW = "XXXX"

i also have a line before all this that is
10/19/2004 12:08:02 AM - Requested IMAP connection from 24.166.229.22 [24.166.229.22], ID=757

id like the
Login_Protocal = "IMAP"
Login_IP = "24.166.229.22 "
Login_ID = "757"

one thing that i think may help is the id is in both lines so it can be assoicated with it maybe..

i do not understand how to parse this for the info to be in strings..
my other problem is there is alot of them with diffrent users.

id like it to break down the logons by time user loged on with what ip..sorted by users email

i assume i need to do arrays but i ahve never done this before so i have no clue how to do this

i could of done this with the mid fuction that vb6 has (was unsure if vb.net has it or not) but i figured vb.net has a better way..maybe faster too


please post code examples

thx
Johnny
aka Pern



0
Comment
Question by:Johnny
  • 15
  • 6
  • 4
25 Comments
 
LVL 48

Expert Comment

by:Mikal613
ID: 12351623
id split it split(yourstring," ")

and then
(1)                   (2)     (3)                         (7)                 (8)                                  (9)
10/19/2004 12:08:03 AM - (   757) 9fe2 LOGIN "jsangel@dragonsworkshop.com" "XXXX"
0
 

Author Comment

by:Johnny
ID: 12351857
ok that does not answer my full question tho..

problems are

ID=757
how would i return just
Login_ID = "757"

and how would i assign an array to it for multible users and logons

i tryed split  with a space as chop.. but i got lost in tracking it some...
i liked that way the best outa all the things ive tried.. but again i got lost how to group them
so thats why i asked my question i couldnt figure out how to parse all the info corectly
0
 
LVL 48

Expert Comment

by:Mikal613
ID: 12351884
split that with a "="

or replace ("ID=","")
0
 

Author Comment

by:Johnny
ID: 12352942
sample logfile:

10/19/2004 12:08:02 AM - Requested IMAP connection from 24.166.229.22 [24.166.229.22], ID=757
10/19/2004 12:08:03 AM - (   757) 9fe2 LOGIN "jsangel@dragonsworkshop.com" "xxx"
10/19/2004 12:08:03 AM - (   757) 9fe2 OK LOGIN successful
10/19/2004 12:08:05 AM - IMAP connection with 24.166.229.22 [24.166.229.22] ended. ID=757

10/19/2004 12:08:05 AM - Requested IMAP connection from 24.166.229.22 [24.166.229.22], ID=758
10/19/2004 12:08:05 AM - (   758) jpsy LOGIN "jsangel@dragonsworkshop.com" "xxx"
10/19/2004 12:08:05 AM - (   758) jpsy OK LOGIN successful
10/19/2004 12:08:09 AM - IMAP connection with 24.166.229.22 [24.166.229.22] ended. ID=758

code i have so far
        Dim LogFile As Long
        LogFile = FreeFile()
        Dim str As String
        'Dim strng2 As Collection
        Dim txtSearchString As String
        Dim x As Integer

        txtSearchString = "LOGIN "
        FileOpen(LogFile, "../../logs/2004-10-18.txt", OpenMode.Input, OpenAccess.Read)
        While Not EOF(LogFile)
            Str = LineInput(LogFile)
            'strng2 = Mid(str, 8, 80)
            'strng2 = Split(str, " ")
            x = InStr(1, str, txtSearchString, CompareMethod.Text)
            If x > 0 Then
                ListBox1.Items.Add(str)
            End If
        End While
        FileClose()

--------------------------
its finding the lines
10/19/2004 12:08:03 AM - (   757) 9fe2 LOGIN "jsangel@dragonsworkshop.com" "xxx"
10/19/2004 12:08:03 AM - (   757) 9fe2 OK LOGIN successful
i only want line
10/19/2004 12:08:03 AM - (   757) 9fe2 LOGIN "jsangel@dragonsworkshop.com" "xxx"

i noticed that the id of 757 and 758 are in patterns is there a way to know if the line is id 757 and then look for

find and asign
Login_Protocal = "IMAP"
Login_IP = "24.166.229.22 "
Login_ID = "757"

then look in line that contain 757 for
10/19/2004 12:08:03 AM - (   757) 9fe2 LOGIN "jsangel@dragonsworkshop.com" "xxx"
breaking it apart to
Login_Date = "10/19/2004"
Login_Time = "12:08:03 AM "
Login_Email = "jsangel@dragonsworkshop.com"
Login_PW = "XXXX"

telling me i can use split to do this does not help me ive been plugging away at this for a bit now and i keep gaving problems saying there has to be an easer way

i want to display in a listbox
**---------------------------------------------------**
Login_ID = "757"
Login_Protocal = "IMAP"
Login_IP = "24.166.229.22 "
Login_Date_time = "10/19/2004 - 12:08:03 AM "
Login_Email = "jsangel@dragonsworkshop.com"
Login_PW = "XXXX"
LogOff_Date_Time = "10/19/2004 - 12:08:05 AM "
**---------------------------------------------------**

then repeats for 758's info etc till end of logfile

in looking for this type of thing
right now im having a problem with keeping track of how to do this and im getting false things with lines like the two login's

im not looking for a single line like split..im looking for the logic and the code to acomplish this..its driving me nuts
im still learning vb.net from vb6 (i most likely can do this in vb6 but vb.net does things totaly diffrent

thanks for your help in advance
Johnny
aka Pern
0
 
LVL 48

Expert Comment

by:Mikal613
ID: 12353074
the file has to be consisted
0
 
LVL 48

Expert Comment

by:Mikal613
ID: 12353076
try an access db or an excel spreadsheet 4 better results
0
 
LVL 19

Expert Comment

by:arif_eqbal
ID: 12355157
See you have a clear Pattern here
There are Four lines For each Request

Line 1: It defines the Request It contains the protocol, IP, Login ID and date & Time of request, This line has a Key Word REQUEST

Line 2: It defines the Login parameters like Mail ID, Password etc.

Line 3: Contains whether Request was Successful (Keyword SUCCESSFUL)

Now you can Look for these three lines only and get your values

Split the First Line with Space, So you get an Array of Date, Time, Protocol, IP, and ID
All these parameters will be directly available as array members but ID will be ID=757 So use
Your_ID_Variable=Arr(i).Substring(Arr(i).IndexOf("=") - 1)

Splitting second line with Space will give all values as array Members

The last Array member after Split of the Thhird line will give you whether connection was successful or not.

If you want I can try it out and give you a sample code

0
 

Author Comment

by:Johnny
ID: 12368681
arif_eqbal,

can you wait till friday ill give you a actual log file to use..as it has more then the sample code above... to see if we can parse out the info corectly.

i have to work today and will not be back till late..

that sounds about right tho.. i would love a code example...

thx
Johnny
aka Pern
0
 
LVL 19

Expert Comment

by:arif_eqbal
ID: 12368702
Sure
0
 

Author Comment

by:Johnny
ID: 12374406
ok heres an actual log snip...

http://dragonsworkshop.com/email_log/sample_log.txt

im trying to pull the above info from it...

thanks
Johnny
aka Pern
0
 
LVL 19

Expert Comment

by:arif_eqbal
ID: 12378983
I have downloaded your file
I'll develop a full working code for you
But sorry to say that I am a bit today
Mind if I get back to you tomorrow!!!!!

0
 

Author Comment

by:Johnny
ID: 12380307
im in no rush!!
0
What Security Threats Are You Missing?

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

 

Author Comment

by:Johnny
ID: 12397164
but i would like to know the solution...i asume you where trying to say u are sick(if so hope you fell better)

awaiting for the answer....

thx
0
 
LVL 19

Accepted Solution

by:
arif_eqbal earned 500 total points
ID: 12398118
Hi Pern

Sorry for the delay, Its not that I was unwell forgot to type Busy in my previous comment

Here's a sample code, I have run it on the sample sent by you it works fine
It does not have Error Checkings though, you might need to add it.

What I have done is created a Structure to hold all the parameters like Login Date Time, Mail ID, IP etc. and for each Login ID I am creating an Array element for the Structure variable array. I have not taken Password as it is always XXX so no point storing that.

Here's the structure and the variable array declared at Form Level

   Public Structure LoginDetails
        Dim Login_ID As String
        Dim Login_Email As String
        Dim Login_Protocal As String
        Dim Login_IP As String
        Dim Login_Date_Time As String
        Dim Logoff_Date_Time As String
    End Structure

    Dim LoginDetail() As LoginDetails

I'll dynamically add elements to LoginDetail using Redim Preserve

Now here's the code, There are three functions ParseFile being the main
I have tried to put some comments in the code, I am poor at it so please bear

    Private Sub ParseFile(Optional ByVal Fl As String = "C:\sample_log.txt")
        Dim FNo As Integer = FreeFile()
        Dim Str As String
        Dim Index As Integer
        Dim TmpStr As String
        Dim TmpArr() As String

        FileOpen(FNo, Fl, OpenMode.Input, OpenAccess.Read)
        While Not EOF(FNo)
            Str = LineInput(FNo)
            'Check For Connection Request
            If Str.IndexOf(" Requested ") >= 0 AndAlso Str.IndexOf(" connection ") >= 0 Then
                'Check if Structure array is empty (This Checking not required in other IF conditions)
                If LoginDetail Is Nothing Then
                    Index = 0
                Else
                    Index = LoginDetail.Length
                End If
                ReDim Preserve LoginDetail(Index)
                'Splitting on "-" will be easier for this String
                TmpArr = Str.Split("-")
                'First Element Forms Date & Time
                LoginDetail(Index).Login_Date_Time = TmpArr(0)
                'ID will be After Keyword "ID="
                LoginDetail(Index).Login_ID = TmpArr(1).Substring(TmpArr(1).IndexOf("ID=") + 3) '+3 is for skipping ID=
                'Protocol is between "Requested" And "Connection"
                TmpStr = Str.Substring(Str.IndexOf("Requested ") + 10, Str.IndexOf("connection ") - Str.IndexOf("Requested ") - 10).Trim
                LoginDetail(Index).Login_Protocal = TmpStr

                'IP is between "[" And "]"
                TmpStr = Str.Substring(Str.IndexOf("[") + 1, Str.IndexOf("]") - Str.IndexOf("[") - 1)
                LoginDetail(Index).Login_IP = TmpStr

            ElseIf Str.IndexOf(" LOGIN ") >= 0 AndAlso Str.IndexOf("@") >= 0 Then
                Str = Str.Substring(Str.IndexOf(" - "))
                'Get the Login ID for which we are extracting Mail ID
                'Since Login IDs are interlaced we need to be sure that the Mail ID is set to the correct Login ID So a separate function for it
                TmpStr = Str.Substring(Str.IndexOf("(") + 1, Str.IndexOf(")") - Str.IndexOf("(") - 1).Trim
                TmpArr = Str.Split("""")
                UpdateMailID(TmpStr, TmpArr(1))

            ElseIf Str.IndexOf(" LOGOUT ") >= 0 AndAlso Str.IndexOf("completed") >= 0 Then
                TmpArr = Str.Split("-")
                'Get ID
                TmpStr = Str.Substring(Str.IndexOf("(") + 1, Str.IndexOf(")") - Str.IndexOf("(") - 1).Trim
                'First Element Forms Date & Time of Logout
                UpdateLogout(TmpStr, TmpArr(0))
            End If
        End While
        FileClose(FNo)

    End Sub

    Private Sub UpdateMailID(ByVal LoginID As String, ByVal MailID As String)
        'These Two functions search based on the Login ID and update the MailID or Logout Time
        'This is because the Index might be pointing to some other user who logged in before
        'this guy logged out or provided his mail ID
        Dim i As Integer
        For i = 0 To LoginDetail.Length - 1
            If LoginDetail(i).Login_ID = LoginID Then
                LoginDetail(i).Login_Email = MailID
                Exit Sub
            End If
        Next
        'Error if execution comes here: Login ID and Mail ID do not match (Should Not happen)
    End Sub

    Private Sub UpdateLogout(ByVal LoginID As String, ByVal LogoutDateTime As String)
        Dim i As Integer
        For i = 0 To LoginDetail.Length - 1
            If LoginDetail(i).Login_ID = LoginID Then
                LoginDetail(i).Logoff_Date_Time = LogoutDateTime
                Exit Sub
            End If
        Next
        'Error if execution comes here: Login ID and Logout ID do not match (Should Not happen)
    End Sub

Now this works fine for IMAP requests I have seen one SMTP request (User ID 762) There I could not figure out from the small file that you sent the Mail ID which we need to capture, there are obviously lot of Mail IDs due to SMTP connection which is the one for the user?? Probably you can figure it out and modify the code so that even that is picked

Hope it helps
Ask me if you have any clarification in the code...

0
 

Author Comment

by:Johnny
ID: 12399588
reviewing code...will advise...
0
 

Author Comment

by:Johnny
ID: 12399713
how do i populate a listbox for now with the info..

the below code seams not to work..i have errors...and if i redim the vars wont that erase them??


    Private Sub Form1_Load(ByVal sender As Object, ByVal e As System.EventArgs) Handles Me.Load
        ParseFile()
        ListBox1.Items.Add("Login_ID: " & Login_ID) 'Login_ID
        ListBox1.Items.Add("Login_Email: " & Login_Email) 'Login_Email
        ListBox1.Items.Add("Login_Protocal: " & Login_Protocal) 'Login_Protocal
        ListBox1.Items.Add("Login_IP: " & Login_IP) 'Login_IP
        ListBox1.Items.Add("Login_Date_Time: " & Login_Date_Time) 'Login_Date_Time
        ListBox1.Items.Add("Logoff_Date_Time: " & Logoff_Date_Time) 'Logoff_Date_Time


    End Sub

and thx..
0
 

Author Comment

by:Johnny
ID: 12399780
i got it see code below THIS IS PERFECT!!!

it does parse the smtp line too...
im going to test on a full log and see what happens but i can now manipulate the output with the populated info..thats what i wanted...

im trying to make a stats of each user and send them emails each week on there useage... (just playing around, see if i can get it all to work)


thanks alot this is great
Johnny
aka Pern
0
 

Author Comment

by:Johnny
ID: 12399959
i found that pop3 and smtp do not have logoff details and pop3 does nto have email...you mentioned somethiong about only imap works..is this what u ment?? im trying to figure out how to get pop3 and smtp to finish the info...if finds them but does nto complete info... also i would need password as it does change (i xxx um so other could not hack it as its a live server)

i would be happy to email u a full log to see all this... ill post my email so u dont get spamed

perndrgn@yahoo.com (please put a few * in subject cuz its my spam (dont care) email addy)

i gota find the rfc for email protocal so i can parse this log right ..as i said im making a stats thing to send the users there stats...ive had a few ask for if they could get info like this...

this is great and thx for the extra help...
0
 

Author Comment

by:Johnny
ID: 12400188
ive noticed u parsed the string of
10/24/2004 12:11:21 PM - (   238) ZZZZ OK LOGOUT completed


and a btter one would have been
10/24/2004 12:11:21 PM - {   238} END IMAP
or
10/24/2004 12:11:34 PM - {   240} END POP3
or
10/24/2004 11:34:06 AM - {   221} END SMTP

this way we get the end time on all areas

i also noticed the log grabs the doamin name for ip
10/24/2004 11:47:37 AM - (   223) EHLO mx1.gamblersbank.com
is there a way to grab this info too..

if you can show me how to do this i should be able to get other info myself...
Hopefully

thx again for helping me out
Johnny
aka Pern

ps i tryed to get the end string to parse but im lost(botched it up)





0
 

Author Comment

by:Johnny
ID: 12400267
smtp is the only one to use ehlo ... for domain name

and heres a sample pop3 snip

10/24/2004 10:02:20 AM - Requested POP3 connection from 62.127.12.98 [62.127.12.98], ID=200
10/24/2004 10:02:20 AM - (   200) +OK ArGoSoft Mail Server Pro for WinNT/2000/XP, Version 1.8 (1.8.6.5)
10/24/2004 10:02:20 AM - (   200) CAPA
10/24/2004 10:02:20 AM - (   200) -ERR Unknown command
10/24/2004 10:02:20 AM - (   200) USER postmaster@laymansworld.com
10/24/2004 10:02:20 AM - (   200) +OK Password required for postmaster@laymansworld.com
10/24/2004 10:02:21 AM - (   200) PASS XXXX
10/24/2004 10:02:21 AM - (   200) +OK Mailbox locked and ready
10/24/2004 10:02:21 AM - (   200) CAPA
10/24/2004 10:02:21 AM - (   200) -ERR Unknown command
10/24/2004 10:02:21 AM - (   200) UIDL 1
10/24/2004 10:02:21 AM - (   200) -ERR Message number 1 does not exist
10/24/2004 10:02:21 AM - (   200) LIST
10/24/2004 10:02:21 AM - (   200) +OK
10/24/2004 10:02:22 AM - (   200) .
10/24/2004 10:02:22 AM - (   200) QUIT
10/24/2004 10:02:22 AM - (   200) +OK Aba he
10/24/2004 10:02:22 AM - POP3 connection with 62.127.12.98 [62.127.12.98] ended. ID=200
10/24/2004 10:02:22 AM - {   200} END POP3


thx again..sorry for asking all this
0
 

Author Comment

by:Johnny
ID: 12400285
i never posted the code i used to view the info

Private Sub Form1_Load(ByVal sender As Object, ByVal e As System.EventArgs) Handles Me.Load
        ParseFile()
        Dim i As Integer
        For i = 0 To LoginDetail.Length - 1
            ListBox1.Items.Add("Login_ID: " & LoginDetail(i).Login_ID) 'Login_ID
            ListBox1.Items.Add("Login_Email: " & LoginDetail(i).Login_Email) 'Login_Email
            ListBox1.Items.Add("Login_Protocal: " & LoginDetail(i).Login_Protocal) 'Login_Protocal
            ListBox1.Items.Add("Login_IP: " & LoginDetail(i).Login_IP) 'Login_IP
            ListBox1.Items.Add("Login_Date_Time: " & LoginDetail(i).Login_Date_Time) 'Login_Date_Time
            ListBox1.Items.Add("Logoff_Date_Time: " & LoginDetail(i).Logoff_Date_Time) 'Logoff_Date_Time
            ListBox1.Items.Add("#------------------------------------------#") 'Sep Line

        Next i


    End Sub

sorry
0
 
LVL 19

Expert Comment

by:arif_eqbal
ID: 12409136
I hope you got a start now
Yes in SMTP there's no Email and logout time, that's what I mentioned if it is that way in the log we can not do anything, but if it was missing in the log that you sent me but actually it is being logged then we can pick that also

As for POP3 you must be getting the Login date time but no logout and mail id

And yes you are right if we pick END instead of LOGOUT we might get logout date time for all protocols so Replace the Last EndIF i.e.

ElseIf Str.IndexOf(" LOGOUT ") >= 0 AndAlso Str.IndexOf("completed") >= 0 Then
..... This block

with this code

 ElseIf Str.IndexOf("  END ") >= 0  Then
                TmpArr = Str.Split("-")
                'Get ID
                TmpStr = Str.Substring(Str.IndexOf("{") + 1, Str.IndexOf("}") - Str.IndexOf("{") - 1).Trim '---> The brackets have changed ( to {
                'First Element Forms Date & Time of Logout
                UpdateLogout(TmpStr, TmpArr(0))


Thanks

0
 

Author Comment

by:Johnny
ID: 12421110
im still trying to figure all this out...but it works great...thx

hopefully ill be able to parse the rest of the info too

0
 

Author Comment

by:Johnny
ID: 12430032
im trying to parse the start line...so i get delivery,smtp,pop3, and imap corectly as the protocal line we have been parseing is not right and i cant get it...im banging my head agenst the wall...

any help???

i dont understand how this all works...ive tryed looking up the tokens..and what not but im still confused...

nor do i understand how its being read...(populated into the checking)

im really lost..
thx for any help arif_eqbal
and sorry for asking so much...!
0
 
LVL 19

Expert Comment

by:arif_eqbal
ID: 12430326
OK Lets look at the first Line Parsing i.e. the first If  block

'Open the File in Read Mode
 FileOpen(FNo, Fl, OpenMode.Input, OpenAccess.Read)
        'Loop through all the lines
        While Not EOF(FNo)
            'Read One Line at a Time
            Str = LineInput(FNo)
       'Now whenever a Request comes Our Log file logs it as "Requested IMAP connection"
'or "Requested SMTP connection" So all we need to do is Check if the Line currently Read
'contains both the words "Requested" and "Connection" if yes get inside the If block
            If Str.IndexOf(" Requested ") >= 0 AndAlso Str.IndexOf(" connection ") >= 0 Then
                'Now get the Index for the array where we will keep the values
                'If array LoginDetail is so far nothing then start from 0 Index otherwise write
                'on the last index i.e. Length of array
                If LoginDetail Is Nothing Then
                    Index = 0
                Else
                    Index = LoginDetail.Length
                End If
                'Redim the array to hold the new element
                ReDim Preserve LoginDetail(Index)

             'Now we have the storage place and we know this is the Connection request line
             'So Now we will try and extract values from this line
             'On the left of Dash "-" we have the Date Time value so first thing split it on dash

                TmpArr = Str.Split("-")
                'Now Since the Line has only one dash TmpArr will have two elements one
               ' containing value on the left of dash and one containing value on the Right
               
                'First Element will be Date & Time so just store it
                LoginDetail(Index).Login_Date_Time = TmpArr(0)
               
             'Now Second Element of Array will contain the User ID at the very end of the line
             'After the keyword ID= eg ID=769
             'So what we do, we get the Index of keyword ID= in the line and
       'move 3 places ahead so that I D and = are skipped then we copy the text till the end
                LoginDetail(Index).Login_ID = TmpArr(1).Substring(TmpArr(1).IndexOf("ID=") + 3) '+3 is for skipping ID=
               
      'Also the Protocol lies between keywords "Requested" And "Connection" So go to the
      'position where we have Requested keyword then move 10 places ahead as keyword
         'Requested is 9 chars long and one for space, then extract the value till index of
         'keyword Connection is reached

                TmpStr = Str.Substring(Str.IndexOf("Requested ") + 10, Str.IndexOf("connection ") - Str.IndexOf("Requested ") - 10).Trim
                LoginDetail(Index).Login_Protocal = TmpStr

         'Now for IP it is between [ and ] so apply the same logic as above
         'Go to [ move one place ahead and extract values till ] is reached

                TmpStr = Str.Substring(Str.IndexOf("[") + 1, Str.IndexOf("]") - Str.IndexOf("[") - 1)
                LoginDetail(Index).Login_IP = TmpStr


Hope you get this one now
there's similar Logic throughout so probably you can figure them out
If any problems feel free to ask

0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Introduction As chip makers focus on adding processor cores over increasing clock speed, developers need to utilize the features of modern CPUs.  One of the ways we can do this is by implementing parallel algorithms in our software.   One recent…
Introduction When many people think of the WebBrowser (http://msdn.microsoft.com/en-us/library/2te2y1x6%28v=VS.85%29.aspx) control, they immediately think of a control which allows the viewing and navigation of web pages. While this is true, it's a…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
This tutorial demonstrates a quick way of adding group price to multiple Magento products.

758 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

21 Experts available now in Live!

Get 1:1 Help Now