use strict;
my $str = 'Aug 1 18:27:49 knight sshd[20327]: Failed password for illegal user guest from 218.49.183.17 port 49090 ssh2
Aug 1 18:27:49 knight sshd[20327]: error: Could not get shadow information for NOUSER
Aug 1 18:27:52 knight sshd[20329]: Failed password for admin from 218.49.183.17 port 49266 ssh2
Aug 1 18:27:56 knight sshd[20331]: Failed password for admin from 218.49.183.17 port 49468 ssh2
Aug 1 18:27:58 knight sshd[20334]: Illegal user user from 218.49.183.17
Aug 1 18:27:59 knight sshd[20334]: Failed password for illegal user user from 218.49.183.17 port 49680 ssh2
Aug 1 18:27:59 knight sshd[20334]: error: Could not get shadow information for NOUSER
Aug 1 18:28:02 knight sshd[20336]: Failed password for root from 218.49.183.17 port 49869 ssh2
Aug 1 18:28:05 knight sshd[20347]: Failed password for root from 218.49.183.17 port 50063 ssh2
Aug 1 18:28:12 knight sshd[20349]: Failed password for root from 218.49.183.17 port 50245 ssh2
Aug 1 18:28:14 knight sshd[20352]: Illegal user test from 218.49.183.17
Aug 1 18:28:19 knight sshd[20352]: Failed password for illegal user test from 218.49.183.17 port 50671 ssh2
Aug 1 18:28:19 knight sshd[20352]: error: Could not get shadow information for NOUSER
Aug 1 18:29:55 knight sshd[20402]: Illegal user test from 218.49.183.17
Aug 1 18:29:56 knight sshd[20402]: Failed password for illegal user test from 218.49.183.17 port 52244 ssh2
Aug 1 18:29:56 knight sshd[20402]: error: Could not get shadow information for NOUSER
Aug 1 18:29:58 knight sshd[20404]: Illegal user guest from 218.49.183.17
Aug 1 18:30:02 knight sshd[20406]: Illegal user test from 218.49.183.17
Aug 1 18:30:03 knight sshd[20404]: Failed password for illegal user guest from 218.49.183.17 port 52416 ssh2
Aug 1 18:30:03 knight sshd[20404]: error: Could not get shadow information for NOUSER
Aug 1 18:30:03 knight sshd[20406]: Failed password for illegal user test from 218.49.183.17 port 52558 ssh2
Aug 1 18:30:03 knight sshd[20406]: error: Could not get shadow information for NOUSER
Aug 1 18:30:05 knight sshd[20439]: Failed password for illegal user guest from 218.49.183.17 port 52818 ssh2
Aug 1 18:30:05 knight sshd[20439]: Illegal user guest from 218.49.183.17
Aug 1 18:30:05 knight sshd[20439]: error: Could not get shadow information for NOUSER
Aug 1 18:30:06 knight sshd[20441]: Failed password for admin from 218.49.183.17 port 52851 ssh2
Aug 1 18:30:08 knight sshd[20443]: Failed password for admin from 218.49.183.17 port 53014 ssh2
Aug 1 18:30:09 knight sshd[20445]: Failed password for admin from 218.49.183.17 port 53040 ssh2
Aug 1 18:30:11 knight sshd[20447]: Failed password for admin from 218.49.183.17 port 53192 ssh2';
my $regex = qr/^(\w{3}\s*\d)\s*(\d\d:\d\d:\d\d)\s*(\w+)/mp;
if ( $str =~ /$regex/g ) {
print "Whole match is ${^MATCH} and its start/end positions can be obtained via \$-[0] and \$+[0]\n";
# print "Capture Group 1 is $1 and its start/end positions can be obtained via \$-[1] and \$+[1]\n";
# print "Capture Group 2 is $2 ... and so on\n";
}
# ${^POSTMATCH} and ${^PREMATCH} are also available with the use of '/p'
# Named capture groups can be called via $+{name}
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for Perl, please visit: http://perldoc.perl.org/perlre.html