By using this site, you agree to our updated Privacy Policy and our Terms of Use. Manage your Cookies Settings.
455,847 Members | 1,274 Online
Bytes IT Community
+ Ask a Question
Need help? Post your question and get tips & solutions from a community of 455,847 IT Pros & Developers. It's quick & easy.

Analyse Log file

P: 2
Hello,
I am new on perl and want to do one script who will ask for the name of the log file to analyse and will give the statictics :
1- the covered period of the log (start-end) by date and hours;
2- the total number of lines (traces) foreach adress;
3-the total numbers of traces for each service;
4-the total number of connections pop, ssh and imap;
5- the list of addresses that made a ssh connection and how many for each
6- list of adresses that sent an email by sendmail and how many for each

example of log to ananyle :
Expand|Select|Wrap|Line Numbers
  1. Jan 13 04:05:43 client.IRO.UMontreal.CA sendmail[22674]: i0D95hr8022674: from=root, size=271, class=0, nrcpts=1,
  2. msgid=<200401130905.i0D95hr8022674@client.IRO.UMontreal.CA>,relay=root@localhost
  3. Jan 13 04:05:44 client.IRO.UMontreal.CA sendmail[22674]: i0D95hr8022674: to=root, ctladdr=root (0/1), delay=00:00:01,
  4. mailer=relay, pri=30271, relay=[127.0.0.1], dsn=2.0.0, stat=Sent (i0D95hEt022675 Message accepted for delivery)
  5. Jan 13 04:05:45 server.IRO.UMontreal.CA sendmail[22627]: i0D95jQ6022627: from=<root@gamma.IRO.umontreal.ca>,
  6. size=750, class=0, nrcpts=1,msgid=<200401130905.i0D95hr8022674@client.IRO.UMontreal.CA>,
  7. proto=ESMTP, daemon=MTA, relay=client.IRO.UMontreal.CA [132.204.24.102]
  8. Jan 13 04:08:20 server.IRO.UMontreal.CA sendmail[23390]: i0D98KQ6023390:<cpm2000@IRO.UMontreal.CA>...
  9. User unknown
  10. Jan 13 04:12:41 server.IRO.UMontreal.CA ipop3d[26735]: pop3 service init from 132.204.24.100
  11. Jan 13 04:12:41 server.IRO.UMontreal.CA ipop3d[26735]: Logout user=??? host=server.IRO.UMontreal.CA [132.204.24.100]
  12. Jan 13 04:12:42 server.IRO.UMontreal.CA imapd[26748]: imap service init from 132.204.24.100
  13. Jan 13 04:12:42 server.IRO.UMontreal.CA imapd[26748]: Logout user=??? host=server.IRO.UMontreal.CA [132.204.24.100]
  14. Jan 13 04:13:58 server.IRO.UMontreal.CA sudo: fmserver : TTY=none ; PWD=/home/fmserver/bin ; USER=root ;
  15. COMMAND=/bin/du -sk /home/ouimet
  16. Jan 13 04:15:27 alpha.IRO.UMontreal.CA sshd2[412]: connection from "132.204.24.100"
I start my script with this code :
Expand|Select|Wrap|Line Numbers
  1. #!/usr/bin/perl
  2. print "Gime me the filename";
  3. chop ($name = <STDIN>);
  4. my @file = $name;
  5. open(LOG,"@file") or die "Unable to open logfile:$!\n";
  6. while(<LOG>){
  7.     my @lines = <LOG>;
  8. foreach $ligne (@lignes)
  9. {  }
  10. close(LOG);
Mar 22 '08 #1
Share this Question
Share on Google+
4 Replies


eWish
Expert 100+
P: 971
What kind of log file is this? Basically you will want to loop through the file and split each line into the various chunks of data. Look into the split() function. You will need a common delimiter (ie: whitespace, tab, pipe( | ), comma ( , ) and so on.). Then either use a hash to store the data or an array foreach of the various points of interest.

You could also search CPAN for modules that might handle this task already.


--Kevin
Mar 22 '08 #2

KevinADC
Expert 2.5K+
P: 4,059
1- the covered period of the log (start-end) by date and hours;
2- the total number of lines (traces) foreach adress;
3-the total numbers of traces for each service;
4-the total number of connections pop, ssh and imap;
5- the list of addresses that made a ssh connection and how many for each
6- list of adresses that sent an email by sendmail and how many for each
What have you tried so far? Where are you stuck? Do you have any idea how to start writing code to do any of the things you listed?
Mar 23 '08 #3

P: 2
Hello,
Let me explain more what am trying to do.
I have a log file who contains these lines below :
Expand|Select|Wrap|Line Numbers
  1. Jan-13 04:12:41 server.alpha.allo.com. ipop3d[26735]: pop3 service init from 132.204.24.100
  2. Jan-13 04:12:42 server.alpha.allo.com. imapd[26748]: imap service init from 132.204.24.100
  3. Jan-13 04:05:44 client.alpha.allo.com sendmail[22674]: i0D95hr8022674: to=root, ctladdr=root (0/1), delay=00:00:01,
  4. mailer=relay, pri=30271, relay=[127.0.0.1], dsn=2.0.0, stat=Sent (i0D95hEt022675 Message accepted for delivery)
  5. Jan-13 04:15:27 Andre.alpha.allo.com sshd2[412]: connection from "132.204.24.100"
And I want to creat a script who will give me the informations below :

1- Home many lines
2-the start and end time of the log with date and time
3-How nany lines (traces) of each service
4-How many connexion of POP3, SSH and IMAP do have my log
5-The list of adresses(email) who made a SSH connexion anh how many each
6-the list of adresses (email) who sent an email true sendmail.

And all theses results I wnat to put it on a txt file and sent it by email (using sendmail) to the mail adress contained in the SYSADMIN.

I know you will not do all these things but I really need help, I am not so good in perl and have to finish this work, I really need help I start with the code bellow
Any suggestion idea is welcome, so many days now am reading lot of book and searching is the only thing left to finish my thing
Thanks in advance , here is my start code :
Expand|Select|Wrap|Line Numbers
  1. #!/usr/bin/perl
  2. use strict; use warnings;
  3.  
  4. open my $inputfh, '<', $inputfilename
  5.         or die "$!\n";
  6.  
  7.     my %hostcount;
  8.  
  9.     while (my $line = <$inputfh>) {
  10.         my @data = split /\s+/, $line;
  11.         my $host = $data[2];
  12.         $hostcount{$host} += 1;
  13.     }
  14.  
  15.     print map { "$_ $hostcount{$_}\n" } sort keys %hostcount;
Mar 25 '08 #4

eWish
Expert 100+
P: 971
Please do not start a new thread when you already have a thread started on the same topic and issue. I have merged the threads.

Thank You,

--Kevin
Mar 26 '08 #5

Post your reply

Sign in to post your reply or Sign up for a free account.