Why is my Python regex not matching between whitespace?

Question

I'd like to extract login information from the Linux auth.log and report on it but having trouble with the regex to extract the pertinent information. I thought a group bordered by spaces (.*) would match the complete segment of text between those spaces. It works fine for the first word and user name, but for the IP address, it spits out the entire line of text starting from the IP address. What am I missing?

s='Accepted keyboard-interactive/pam for user101 from 10.19.36.76 port 36272 ssh2'
s2='Postponed keyboard-interactive for user101 from 10.19.36.76 port 36303 ssh2 [preauth]'

w = re.compile ("(.*) keyboard-interactive.*for (.*) from (.*) ");
m = w.search(s2)
if m:
   print "login by:", m.group(2)
   print "src ip  :", m.group(3)
   print "status  :", m.group(1)

OUTPUT:

login by: user101
src ip  : 10.19.36.76 port 36303 ssh2 [preauth]
status  : Postponed

OR:

login by: user101
src ip  : 10.19.36.76 port 36272 ssh2
status  : Accepted

"(.*)" captures also a space, maybe you meant ([^ ]*) ? or, as it has to be an ip "([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})" ? — lejlot
– lejlot, Commented Nov 18, 2015 at 14:37

vks · Accepted Answer · 2015-11-18 14:37:52Z

1

w = re.compile ("(.*?) keyboard-interactive.*for (.*?) from (.*?) ");

                    ^^                              ^^         ^^

Make your regex non greedy

answered Nov 18, 2015 at 14:37

vks

68.1k11 gold badges96 silver badges132 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Kasravnd · Accepted Answer · 2015-11-18 14:42:37Z

1

Because (.*) will match every thing (except new line) after from. If you just want to match IP address you can use a character class like following :

[\d.]+

Or and a much safer approach use following:

((?:\d{1,3}\.){3}\d{1,3})

edited Nov 18, 2015 at 14:42

answered Nov 18, 2015 at 14:37

Kasravnd

108k19 gold badges167 silver badges195 bronze badges

2 Comments

Avinash Raj Over a year ago

or replacing all (.*) with (\S+) would do the job perfectly.

Kasravnd Over a year ago

@AvinashRaj Yep, It has several way but I think the safer one is better.

Collectives™ on Stack Overflow

Why is my Python regex not matching between whitespace?

2 Answers 2

Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related