Analyse Log file

[finelady]

Hello,
I am new on perl and want to do one script who will ask for the name of the log file to analyse and will give the statictics :
1- the covered period of the log (start-end) by date and hours;
2- the total number of lines (traces) foreach adress;
3-the total numbers of traces for each service;
4-the total number of connections pop, ssh and imap;
5- the list of addresses that made a ssh connection and how many for each
6- list of adresses that sent an email by sendmail and how many for each

example of log to ananyle :

Jan 13 04:05:43 client.IRO.UMontreal.CA sendmail[22674]: i0D95hr8022674: from=root, size=271, class=0, nrcpts=1,
msgid=<[e-mail]>,relay=root@localhost
Jan 13 04:05:44 client.IRO.UMontreal.CA sendmail[22674]: i0D95hr8022674: to=root, ctladdr=root (0/1), delay=00:00:01,
mailer=relay, pri=30271, relay=[127.0.0.1], dsn=2.0.0, stat=Sent (i0D95hEt022675 Message accepted for delivery)
Jan 13 04:05:45 server.IRO.UMontreal.CA sendmail[22627]: i0D95jQ6022627: from=<[e-mail]>,
size=750, class=0, nrcpts=1,msgid=<[e-mail]>,
proto=ESMTP, daemon=MTA, relay=client.IRO.UMontreal.CA [132.204.24.102]
Jan 13 04:08:20 server.IRO.UMontreal.CA sendmail[23390]: i0D98KQ6023390:<[e-mail]>...
User unknown
Jan 13 04:12:41 server.IRO.UMontreal.CA ipop3d[26735]: pop3 service init from 132.204.24.100
Jan 13 04:12:41 server.IRO.UMontreal.CA ipop3d[26735]: Logout user=??? host=server.IRO.UMontreal.CA [132.204.24.100]
Jan 13 04:12:42 server.IRO.UMontreal.CA imapd[26748]: imap service init from 132.204.24.100
Jan 13 04:12:42 server.IRO.UMontreal.CA imapd[26748]: Logout user=??? host=server.IRO.UMontreal.CA [132.204.24.100]
Jan 13 04:13:58 server.IRO.UMontreal.CA sudo: fmserver : TTY=none ; PWD=/home/fmserver/bin ; USER=root ;
COMMAND=/bin/du -sk /home/ouimet
Jan 13 04:15:27 alpha.IRO.UMontreal.CA sshd2[412]: connection from "132.204.24.100"

I start my script with this code :

#!/usr/bin/perl
print "Gime me the filename";
chop ($name = <STDIN>);
my @file = $name;
open(LOG,"@file") or die "Unable to open logfile:$!\n";
while(<LOG>){
    my @lines = <LOG>;
foreach $ligne (@lignes)
{  }
close(LOG);

[eWish]

What kind of log file is this? Basically you will want to loop through the file and split each line into the various chunks of data. Look into the split() function. You will need a common delimiter (ie: whitespace, tab, pipe( | ), comma ( , ) and so on.). Then either use a hash to store the data or an array foreach of the various points of interest.

You could also search CPAN for modules that might handle this task already.


--Kevin

[KevinADC]

1- the covered period of the log (start-end) by date and hours;
2- the total number of lines (traces) foreach adress;
3-the total numbers of traces for each service;
4-the total number of connections pop, ssh and imap;
5- the list of addresses that made a ssh connection and how many for each
6- list of adresses that sent an email by sendmail and how many for each

What have you tried so far? Where are you stuck? Do you have any idea how to start writing code to do any of the things you listed?

[finelady]

Hello,
Let me explain more what am trying to do.
I have a log file who contains these lines below :

Jan-13 04:12:41 server.alpha.allo.com. ipop3d[26735]: pop3 service init from 132.204.24.100
Jan-13 04:12:42 server.alpha.allo.com. imapd[26748]: imap service init from 132.204.24.100
Jan-13 04:05:44 client.alpha.allo.com sendmail[22674]: i0D95hr8022674: to=root, ctladdr=root (0/1), delay=00:00:01,
mailer=relay, pri=30271, relay=[127.0.0.1], dsn=2.0.0, stat=Sent (i0D95hEt022675 Message accepted for delivery)
Jan-13 04:15:27 Andre.alpha.allo.com sshd2[412]: connection from "132.204.24.100"

And I want to creat a script who will give me the informations below :

1- Home many lines
2-the start and end time of the log with date and time
3-How nany lines (traces) of each service
4-How many connexion of POP3, SSH and IMAP do have my log
5-The list of adresses(email) who made a SSH connexion anh how many each
6-the list of adresses (email) who sent an email true sendmail.

And all theses results I wnat to put it on a txt file and sent it by email (using sendmail) to the mail adress contained in the SYSADMIN.

I know you will not do all these things but I really need help, I am not so good in perl and have to finish this work, I really need help I start with the code bellow
Any suggestion idea is welcome, so many days now am reading lot of book and searching is the only thing left to finish my thing
Thanks in advance , here is my start code :

#!/usr/bin/perl
use strict; use warnings;
 
open my $inputfh, '<', $inputfilename
        or die "$!\n";
 
    my %hostcount;
 
    while (my $line = <$inputfh>) {
        my @data = split /\s+/, $line;
        my $host = $data[2];
        $hostcount{$host} += 1;
    }
 
    print map { "$_ $hostcount{$_}\n" } sort keys %hostcount;

[eWish]

Please do not start a new thread when you already have a thread started on the same topic and issue. I have merged the threads.

Thank You,

--Kevin