Creating a script to harvest a list of IP addresses:

Bit of an attack on one of the routers I manage (as a volunteer, for my church) last night:

Warning	Connection	2021/07/27 09:48:27	SYSTEM	User [admin] from [213.214.18.79] failed to log in via [DSM] due to authorization failure.
Warning	Connection	2021/07/27 09:48:21	SYSTEM	User [admin] from [77.48.235.45] failed to log in via [DSM] due to authorization failure.
Warning	Connection	2021/07/27 09:48:04	SYSTEM	User [admin] from [122.117.110.172] failed to log in via [DSM] due to authorization failure.
Warning	Connection	2021/07/27 09:47:56	SYSTEM	User [admin] from [95.155.205.117] failed to log in via [DSM] due to authorization failure.

And on, and on for 363 lines. I’d like to harvest a list of just the IP addresses from these logs exported to spreadsheet in CSV format, so that I can add them to my router’s blacklist. But I’ve never used macros or scripting before in LibreOffice. Could anyone point me in the right direction?

Have you tried grep command to filter the log then some bash, sed, perl or awk to keep only the IP? Would surely be easier.

I’m not familiar with grep; I’ll have to look it up.

First Step: Find out what to do.
In this case a simple search and replace will do, as LibreOffice contains also ICU regular expressions,
similiar to grep, awk.

You need to replace .*\[admin\] from \[(.*?)\].* with _$1_

You may recognise: Search for “something until [admin] from [”

As brackets have a special meaning, the have to be protected (quoted)

The () make the found item within available as $1 in Replace

The ? is very important - without the Pattern woul greedy run to the following ] after DSM - but here it stays “lazy”.
The underscore in the replace expression prevents the removal of the dots, by calc after it “detects” the number.

Option: Regular Expression.
then “Replace all”


Second Step: Wrap it in a macro,
and in simple cases these can be recorded - wich I did here:

    sub getIP
rem ----------------------------------------------------------------------
rem define variables
dim document   as object
dim dispatcher as object
rem ----------------------------------------------------------------------
rem get access to the document
document   = ThisComponent.CurrentController.Frame
dispatcher = createUnoService("com.sun.star.frame.DispatchHelper")

rem ----------------------------------------------------------------------
dim args1(20) as new com.sun.star.beans.PropertyValue
args1(0).Name = "SearchItem.StyleFamily"
args1(0).Value = 2
args1(1).Name = "SearchItem.CellType"
args1(1).Value = 0
args1(2).Name = "SearchItem.RowDirection"
args1(2).Value = true
args1(3).Name = "SearchItem.AllTables"
args1(3).Value = false
args1(4).Name = "SearchItem.SearchFiltered"
args1(4).Value = false
args1(5).Name = "SearchItem.Backward"
args1(5).Value = false
args1(6).Name = "SearchItem.Pattern"
args1(6).Value = false
args1(7).Name = "SearchItem.Content"
args1(7).Value = false
args1(8).Name = "SearchItem.AsianOptions"
args1(8).Value = false
args1(9).Name = "SearchItem.AlgorithmType"
args1(9).Value = 1
args1(10).Name = "SearchItem.SearchFlags"
args1(10).Value = 65536
args1(11).Name = "SearchItem.SearchString"
args1(11).Value = ".*\[admin\] from \[(.*?)\].*"
args1(12).Name = "SearchItem.ReplaceString"
args1(12).Value = "_$1_"
args1(13).Name = "SearchItem.Locale"
args1(13).Value = 255
args1(14).Name = "SearchItem.ChangedChars"
args1(14).Value = 2
args1(15).Name = "SearchItem.DeletedChars"
args1(15).Value = 2
args1(16).Name = "SearchItem.InsertedChars"
args1(16).Value = 2
args1(17).Name = "SearchItem.TransliterateFlags"
args1(17).Value = 1073743104
args1(18).Name = "SearchItem.Command"
args1(18).Value = 3
args1(19).Name = "SearchItem.SearchFormatted"
args1(19).Value = false
args1(20).Name = "SearchItem.AlgorithmType2"
args1(20).Value = 2

dispatcher.executeDispatch(document, ".uno:ExecuteSearch", "", 0, args1())

rem ----------------------------------------------------------------------
dim args2(0) as new com.sun.star.beans.PropertyValue
args2(0).Name = "Visible"
args2(0).Value = false

dispatcher.executeDispatch(document, ".uno:SearchResultsDialog", "", 0, args2())


end sub

This can be done more elegant without the dispatcher, but it is quickly done this way. You may recognize the regular expression in the middle of the code.


Third step
For easy access I added a simple push-button, triggered when the button gets focus.
(Click somewhere else, if it runs more than once…) and you find the file as attachment.

Now we’d need to save your IP-list or transform it so your router will accept it.

J.

PS: In real world many people have no fixed IP, so it may be useful to release the ban after some time…

getIP.ods