savo
User
Oct 21, 2009, 9:34 AM
Post #15 of 15
(1185 views)
|
|
Re: [AngeloSpinola] Filtering Log files and Splitting by time.
[In reply to]
|
Can't Post
|
|
I did not get as much time as i wanted today (kids are ill) but i have worked on it a little.
When run by default it will write all the logs to files by day. You will either have to edit it or add a logs dir. It will add data to the end of the log file so if its ran against the same log file more than once it will add duplicate data to the end. This inst to hard to fix either have it overwrite the old file or add some checking.
if you run it with command -s you will get a date prompt enter the date like 16/10/2009 (it is split on any none digit so 16*10^2009 would work as well).
If you run with the -v it will display all the data to the screen, I did have it outputting better but that broke when i put it in a subroutine.
Could you send me a sample log file so i can play some more when have time.
EDIT
The sort by date is not working i couldn't quite work it out will start my own post about that and add it after.
#!/usr/bin/perl
use warnings;
use strict;
use 5.010;
my $lookup;
my %hash;
my %count;
sub dateconversion {
my $num = shift;
my @month = qw(JAN FEC MAR APR MAY JUE JUL AUG SEP OCT NOV DEC);
my $r = $month[$num];
}
sub search {
my $date = shift;
my $time = shift;
my $ip = shift;
my $count = shift;
my $lastdate = shift;
my @lookup = split /\D/, $lookup;
--$lookup[1];
$lookup[1] = dateconversion( $lookup[1] );
my $daytolookup = join "-", @lookup;
say "$ip -- $date -- $time -- $count", if $date eq $daytolookup;
}
sub outputtoscreen {
my $date = shift;
my $time = shift;
my $ip = shift;
my $count = shift;
# my $lastdate =1;
# say "---------------", unless $lastdate eq $date; broken this now its passed to a sub
say "$ip -- $date -- $time -- $count";
$lastdate = $date;
# $lastdate = shift;
}
sub outputtofile {
my $date = shift;
my $time = shift;
my $ip = shift;
my $count = shift;
my $lastdate = shift;
if ( !open OUTPUT, ">>logs/logger-$date" ) {
die "didnt open? ($!)";
}
select OUTPUT;
say "$ip -- $date -- $time -- $count{$ip}";
$lastdate = $date;
select STDOUT;
}
if ( $ARGV[0] =~ /-s/ ) {
say "Please enter a date to lookup";
chomp( $lookup = <STDIN> );
}
if ( !open TEST, "test" ) {
die "didnt open? ($!)";
}
while (<TEST>) {
chomp;
my ( $date, $time, $dump, $ip ) = split / /, $_;
$date =~ s/<txt>//;
${ $hash{$date}{$time}{$ip} } +=
1; #this needs fixing as no need to count will always be 1
$count{$ip} += 1;
}
close TEST;
foreach my $date ( sort keys %hash ) {
my $lastdate = 1;
for my $time ( sort keys %{ $hash{$date} } ) {
for my $ip ( sort keys %{ $hash{$date}{$time} } ) {
if ( $ARGV[0] =~ /-v/ ) {
outputtoscreen( $date, $time, $ip, $count{$ip}, $lastdate );
}
elsif ( $ARGV[0] =~ /-s/ ) {
search( $date, $time, $ip, $count{$ip}, $lastdate );
}
else {
outputtofile( $date, $time, $ip, $count{$ip}, $lastdate );
}
}
}
}
(This post was edited by savo on Oct 21, 2009, 9:36 AM)
|
MAIN
SEARCH
WHO'S 
LOG 