Stuff

use strict;
use warnings;

my $vhost = 'access';
my $log_line = undef;
my %is_open = undef;

%is_open = ();

while ($log_line = <>) {
    #
    # Get the first token from the log record; it's the
    # identity of the virtual host to which the record
    # applies.
    #
    ($vhost) = split (/\s/, $log_line);
    #$log_line =~ s/^(\S*)\s+//;
    #$vhost = $1;
    #
    # Normalize the virtual host name to all lowercase.
    # If it's blank, the request was handled by the default
    # server, so supply a default name.  This shouldn't
    # happen, but caution rocks.
    #
    $vhost = lc ($vhost) || "access";
    #
    # if the vhost contains a "/" or "\", it is illegal so just use
    # the default log to avoid any security issues due if it is interprted
    # as a directory separator.
    if ($vhost =~ m#/\\#) { $vhost = "access" }
    # if ($vhost =~ /- /) { $vhost = "access" }
    # $vhost = 'access' if $vhost =~ m![/\\]!;
    # $vhost = 'access' if $vhost =~ /- /;
    #
    # If the log file for this virtual host isn't opened
    # yet, do it now.
    #
    if (! $is_open{$vhost}) {
        open FH, ">>", $vhost.".log"
             or die ("Can't open ${vhost}.log");
        $is_open{$vhost} = 1;
    }
    #
    # Strip off the first token (which may be null in the
    # case of the default server), and write the edited
    # record to the current log file.
    #
    $log_line =~ s/^\S*\s+//;
    print FH $log_line;
}
exit 0;