I have a log file from my SFTP server. It is probably thousands of lines long. My goal is to create an console app that finds text in the file, then uses that text to print just the parts of the file I want to look at. Here is one portion of the file that I want to look at:
event seq="1234" time="2017-11-15 07:04:16.577538 -0800" app="BvSshServer 5.56" name="I_LOGON_AUTH_SUCCEEDED" desc="User authentication succeeded."> session id="2689" remoteAddress="123.456.78.910:12345" virtualAccount="User" windowsAccount="CmpNme\VirtualUsers"/> authentication attemptNr="1" userName="user" method="password"/> /event>
My goal is to run a search for "I_LOGON_AUTH_SUCCEEDED" and then when that is found, I want the program to search for "remoteAddress=" and then cout the "123.456.78.910:12345" address. Then I want to do the same search for the "virtualAccount=" and cout the "User"
At the moment, I am still fumbling with how to import the file and I have absolutely no idea how to actually seperate the output from the rest of the document... This is my sudo code.
#include <iostream>
#include <fstream>
#include <string>
using namespace std;
int main()
{
string fi ("I_LOGON_AUTH_SUCCEEDED"); //original search term
string xadr ("remoteAddress="); //address search text
string xuser ("virtualAccount="); //username search text
ifstream logfile("Logfilelocation.log"); //I have no idea how to actually import a file's contents.
while (logfile.find(fi) != EOF) //This should find the original string in the file, then repeat until EOF.
{
adrloc = logfile.find(xadr); //From here I am not even sure how to go about this.
adr = text at adrloc + 1; //My goal is to find the xadr value and then print the address that comes after.
userloc = logfile.find(xuser); //Then I want to find the xuser value and print the username that comes after.
user = text at userloc + 1;
cout << adr << " " << user << endl;
}
}
This is all in hopes that I can have an output that looks like this:
123.456.78.910:12345 User
192.168.0.1:34567 Linksys
172.0.0.1:433 admin
Aucun commentaire:
Enregistrer un commentaire