Python regular expression written by yourself

Import re

# Validate logs from admd. Have "from" and have Comma. It mean both "Client IP" and "denied reason" is given by appliance.
Def validate_re1 ():
Print 'the following test case shocould succeed :'
RegEx = 'user \ s + \ [(\ s +) \] \ s + from \ s + (\ D + \. \ D + \. \ D + \. \ D +) \ s + (\ s. *), \ s + (\ s. *)'

Re_match = Re. Search (RegEx, 'adm auth firewall user [hama@qanet.net] From 10.0.1.2 error, reason-LDAP binding not successful ')
Print re_match.group (1) + "|" + re_match.group (2) + "|" + re_match.group (4). Replace ('reason -','')
Re_match = Re. Search (RegEx, 'adm auth firewall user [JASON @ radius] From 10.139.44.131 error, reason-Recv timeout ')
Print re_match.group (1) + "|" + re_match.group (2) + "|" + re_match.group (4). Replace ('reason -','')
Re_match = Re. Search (RegEx, 'adm auth firewall user [Tiger @ firebox-dB] From 10.139.44.131 rejected, password incorrect ')
Print re_match.group (1) + "|" + re_match.group (2) + "|" + re_match.group (4)
Re_match = Re. Search (RegEx, 'adm auth firewall user [123_123 @ firebox-dB] From 10.139.44.131 rejected, user not found ')
Print re_match.group (1) + "|" + re_match.group (2) + "|" + re_match.group (4)
Re_match = Re. Search (RegEx, 'adm auth firewall user [do_ha_ha@tiger.com] From 10.0.1.2 error, reason-LDAP binding not successful ')
Print re_match.group (1) + "|" + re_match.group (2) + "|" + re_match.group (4)
Re_match = Re. Search (RegEx, 'adm auth firewall user [do_ha_ha@tiger.com] From 10.0.1.2 rejected, exceeded login limit ')
Print re_match.group (1) + "|" + re_match.group (2) + "|" + re_match.group (4)
Print '--------------------------------------'

 
# Validate logs from admd. Have "from" but do not have comma
Def validate_re2 ():
Print 'the following test case shocould succeed :'
RegEx = 'user \ s + \ [(\ s +) \] \ s + from \ s + (\ D + \. \ D + \. \ D + \. \ D +) \ s + (\ s. *)'

Re_match = Re. Search (RegEx, 'adm auth firewall user [yyyyyyyyyyy @ radius] From 10.0.1.2 rejected ')
Print re_match.group (1) + "|" + re_match.group (2) + "|" + "N/"
Re_match = Re. Search (RegEx, 'adm auth firewall user [hama@qanet.net] From 10.0.1.2 rejected ')
Print re_match.group (1) + "|" + re_match.group (2) + "|" + "N/"
Print '--------------------------------------'
 
# Validate logs from admd. Have no "from" but have comma
Def validate_re3 ():
Print 'the following test case shocould succeed :'
RegEx = 'user \ s + \ [(\ s +) \] + (\ s *), \ s + (\ s .*)'

Re_match = Re. Search (RegEx, 'adm auth firewall user [yyyyyyyyyyy @ radius] error, radius auth method ytyty not supported ')
Print re_match.group (1) + "|" + "N/A" + "|" + re_match.group (3)

Re_match = Re. Search (RegEx, 'adm auth user [JASON @ radius], both primary and secondary servers are lower ')
Print re_match.group (1) + "|" + "N/A" + "|" + re_match.group (3)
Print '--------------------------------------'

# Validate logs from sessiond.
Def validate_re4 ():
Print 'the following test case shocould succeed :'
# RegEx = 'user \ s + (\ s +) \ s + from \ s + (\ D + \. \ D + \. \ D + \. \ D +) \ s + (\ s. *)'
# Re_match = Re. Search (RegEx, 'firewall user Frank @ radius from 10.139.44.131 rejected 111aaa ')
Log1 = 'management user admin from 172.26.0.107 rejected-admin have login .'
Log2 = 'firewall user Jerry @ firebox-DB from 10.139.36.83 rejected-exceeded Authenticated Users limit'
Log3 = "firewall user Andy @ firebox-DB from 10.0.1.2 rejected-unspecified"
RegEx = 'user \ s + (\ s +) \ s + from \ s + (\ D + \. \ D + \. \ D + \. \ D +) \ s + (\ s. *) \ s-\ s + (\ s. *)'

If log1.find ('objected ')! =-1 and (log1.find ('manager ')! =-1 or log1.find ('exceeded Authenticated Users limit ')! =-1 ):
Re_match = Re. Search (RegEx, log1)
Print "log1 --->" + re_match.group (1) + "|" + re_match.group (2) + "|" + re_match.group (4)

If log2.find ('objected ')! =-1 and (log2.find ('manager ')! =-1 or log2.find ('exceeded Authenticated Users limit ')! =-1 ):
Re_match = Re. Search (RegEx, log2)
Print "log2 --->" + re_match.group (1) + "|" + re_match.group (2) + "|" + re_match.group (4)

Print 'the following test case shocould fail :'
If log3.find ('objected ')! =-1 and (log3.find ('manager ')! =-1 or log3.find ('exceeded Authenticated Users limit ')! =-1 ):
Re_match = Re. Search (RegEx, log3)
Print "log3 --->" + re_match.group (1) + "|" + re_match.group (2) + "|" + re_match.group (4)


If _ name _ = "_ main __":

# Shocould match
Validate_re1 ()
Validate_re2 ()
Validate_re3 ()
Validate_re4 ()

Print '----------------------'