rorysavage77

modSecurityLog="./logs/modsec_audit.log"
securityString1="POST /activfoundation/login/oauth/facebook/callback"
securityString2="HTTP/1.1 400 Bad Request"
detailString="CF-Connecting-IP:"
modsecLogFile="./logs/modsec_audit.log"

$/ = "-Z--\n"; 							## Input Record Seperator to create chunk

iparray = []
timeary = []

rorysavage77

#!/bin/ruby
##################################################################
## modruby - a tools for parsing the modsecurity audit logs and ##
##           taking action.                                     ##
##################################################################

$modSecurityLog="./logs/modsec_audit.log"
$securityString1="POST /activfoundation/login/oauth/facebook/callback"
$securityString2="HTTP/1.1 400 Bad Request"

rorysavage77

    chunk.each_line do |line|
         if line =~ /CF-Connecting-IP: (\d+.\d+.\d+.\d+)/
           cfConntingIp = line.split("CF-Connecting-IP: ", 2)
           puts cfConntingIp


         end
    end