are there any PHP scripts for parsing FTP logs

lawrence k

I have to parse some FTP logs, which are full of several thousand
lines like this:

Thu Sep 4 11:39:04 2008 [pid 12977] [redeye] FTP command: Client
"74.231.146 .2", "TYPE A"
Thu Sep 4 11:39:04 2008 [pid 12977] [redeye] FTP response: Client
"74.231.146 .2", "200 Switching to ASCII mode."
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP command: Client
"74.231.146 .2", "PWD"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP response: Client
"74.231.146 .2", "257 "/634457502123""
Thu Sep 4 11:39:04 2008 [pid 12977] [redeye] FTP response: Client
"74.231.146 .2", "200 Switching to ASCII mode."
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP command: Client
"74.231.146 .2", "PWD"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP response: Client
"74.231.146 .2", "257 "/634457502123""
When a file is uploaded, I need to reconstruct from this log what the
directory path is. Does anyone know if there is a PHP script that
someone has already written that does this?

Sep 5 '08 #1

Subscribe Reply

1726

Curtis

lawrence k wrote:

I have to parse some FTP logs, which are full of several thousand
lines like this:

When a file is uploaded, I need to reconstruct from this log what the
directory path is. Does anyone know if there is a PHP script that
someone has already written that does this?

Google might, but it's not too hard to do it yourself:

PHP standard string functions:
http://php.net/manual/en/ref.strings.php

PCRE (don't use POSIX regex, it's slower and deprecated):
http://php.net/manual/en/regexp.reference.php

--
Curtis

Sep 5 '08 #2

Lawrence Krubner

Curtis wrote:

lawrence k wrote:
>I have to parse some FTP logs, which are full of several thousand
lines like this:

<log snipped>

>When a file is uploaded, I need to reconstruct from this log what the
directory path is. Does anyone know if there is a PHP script that
someone has already written that does this?

Google might, but it's not too hard to do it yourself:

PHP standard string functions:
http://php.net/manual/en/ref.strings.php

PCRE (don't use POSIX regex, it's slower and deprecated):
http://php.net/manual/en/regexp.reference.php

I think you misunderstood me. I probably did not explain myself well.
What I want is a script that can take a few thousand lines that look
like this:
Thu Sep 4 11:39:04 2008 [pid 12977] [redeye] FTP command: Client
"74.231.146 .2", "TYPE A"
Thu Sep 4 11:39:04 2008 [pid 12977] [redeye] FTP response: Client
"74.231.146 .2", "200 Switching to ASCII mode."
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP command: Client
"74.231.146 .2", "PWD"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP response: Client
"74.231.146 .2", "257 "/intake""
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP command: Client
"74.231.146 .2", "CD labels"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP response: Client
"74.231.146 .2", "257 "/labels"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP command: Client
"74.231.146 .2", "CD redeye"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP response: Client
"74.231.146 .2", "257 "/redeye""
Thu Sep 4 11:39:04 2008 [pid 12977] [redeye] FTP response: Client
"74.231.146 .2", "200 Switching to ASCII mode."
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP command: Client
"74.231.146 .2", "PWD"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP response: Client
"74.231.146 .2", "257 "/634457502123""
And give me the correct answer, which is:

/intake/labels/redeye/634457502123

Bonus points for keeping track of the PID and the user, since many users
actions might be intermixed in the logs.

I realize I can do this with PHP string functions, but I'm wondering if
someone has already done it. Seems like it would be a lot of work to do
the script that I'm envisioning.
-- lawrence krubner

Sep 5 '08 #3

Curtis

Lawrence Krubner wrote:

Curtis wrote:
>lawrence k wrote:
>>I have to parse some FTP logs, which are full of several thousand
lines like this:

<log snipped>

>>When a file is uploaded, I need to reconstruct from this log what the
directory path is. Does anyone know if there is a PHP script that
someone has already written that does this?

Google might, but it's not too hard to do it yourself:

PHP standard string functions:
http://php.net/manual/en/ref.strings.php

PCRE (don't use POSIX regex, it's slower and deprecated):
http://php.net/manual/en/regexp.reference.php

I think you misunderstood me. I probably did not explain myself well.
What I want is a script that can take a few thousand lines that look
like this:

Whoops, yes, I misread your post.

Thu Sep 4 11:39:04 2008 [pid 12977] [redeye] FTP command: Client
"74.231.146 .2", "TYPE A"
Thu Sep 4 11:39:04 2008 [pid 12977] [redeye] FTP response: Client
"74.231.146 .2", "200 Switching to ASCII mode."
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP command: Client
"74.231.146 .2", "PWD"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP response: Client
"74.231.146 .2", "257 "/intake""
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP command: Client
"74.231.146 .2", "CD labels"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP response: Client
"74.231.146 .2", "257 "/labels"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP command: Client
"74.231.146 .2", "CD redeye"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP response: Client
"74.231.146 .2", "257 "/redeye""
Thu Sep 4 11:39:04 2008 [pid 12977] [redeye] FTP response: Client
"74.231.146 .2", "200 Switching to ASCII mode."
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP command: Client
"74.231.146 .2", "PWD"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP response: Client
"74.231.146 .2", "257 "/634457502123""
And give me the correct answer, which is:

/intake/labels/redeye/634457502123

Bonus points for keeping track of the PID and the user, since many users
actions might be intermixed in the logs.

I realize I can do this with PHP string functions, but I'm wondering if
someone has already done it. Seems like it would be a lot of work to do
the script that I'm envisioning.

--
Curtis

Sep 5 '08 #4

Jerry Stuckle

Lawrence Krubner wrote:

Curtis wrote:
>lawrence k wrote:
>>I have to parse some FTP logs, which are full of several thousand
lines like this:

<log snipped>

>>When a file is uploaded, I need to reconstruct from this log what the
directory path is. Does anyone know if there is a PHP script that
someone has already written that does this?

Google might, but it's not too hard to do it yourself:

PHP standard string functions:
http://php.net/manual/en/ref.strings.php

PCRE (don't use POSIX regex, it's slower and deprecated):
http://php.net/manual/en/regexp.reference.php

I think you misunderstood me. I probably did not explain myself well.
What I want is a script that can take a few thousand lines that look
like this:
Thu Sep 4 11:39:04 2008 [pid 12977] [redeye] FTP command: Client
"74.231.146 .2", "TYPE A"
Thu Sep 4 11:39:04 2008 [pid 12977] [redeye] FTP response: Client
"74.231.146 .2", "200 Switching to ASCII mode."
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP command: Client
"74.231.146 .2", "PWD"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP response: Client
"74.231.146 .2", "257 "/intake""
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP command: Client
"74.231.146 .2", "CD labels"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP response: Client
"74.231.146 .2", "257 "/labels"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP command: Client
"74.231.146 .2", "CD redeye"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP response: Client
"74.231.146 .2", "257 "/redeye""
Thu Sep 4 11:39:04 2008 [pid 12977] [redeye] FTP response: Client
"74.231.146 .2", "200 Switching to ASCII mode."
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP command: Client
"74.231.146 .2", "PWD"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP response: Client
"74.231.146 .2", "257 "/634457502123""
And give me the correct answer, which is:

/intake/labels/redeye/634457502123

Bonus points for keeping track of the PID and the user, since many users
actions might be intermixed in the logs.

I realize I can do this with PHP string functions, but I'm wondering if
someone has already done it. Seems like it would be a lot of work to do
the script that I'm envisioning.
-- lawrence krubner

I don't know of any pre-written scripts like this, but I wouldn't think
it should be that hard.

--
=============== ===
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@attgl obal.net
=============== ===

Sep 5 '08 #5

Nick S

On Sep 5, 8:19 pm, Lawrence Krubner <lawre...@krubn er.comwrote:

Curtis wrote:
lawrence k wrote:
I have to parse some FTP logs, which are full of several thousand
lines like this:

<log snipped>

When a file is uploaded, I need to reconstruct from this log what the
directory path is. Does anyone know if there is a PHP script that
someone has already written that does this?

Google might, but it's not too hard to do it yourself:

PHP standard string functions:
http://php.net/manual/en/ref.strings.php

PCRE (don't use POSIX regex, it's slower and deprecated):
http://php.net/manual/en/regexp.reference.php

I think you misunderstood me. I probably did not explain myself well.
What I want is a script that can take a few thousand lines that look
like this:

Thu Sep 4 11:39:04 2008 [pid 12977] [redeye] FTP command: Client
"74.231.146 .2", "TYPE A"
Thu Sep 4 11:39:04 2008 [pid 12977] [redeye] FTP response: Client
"74.231.146 .2", "200 Switching to ASCII mode."
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP command: Client
"74.231.146 .2", "PWD"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP response: Client
"74.231.146 .2", "257 "/intake""
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP command: Client
"74.231.146 .2", "CD labels"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP response: Client
"74.231.146 .2", "257 "/labels"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP command: Client
"74.231.146 .2", "CD redeye"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP response: Client
"74.231.146 .2", "257 "/redeye""
Thu Sep 4 11:39:04 2008 [pid 12977] [redeye] FTP response: Client
"74.231.146 .2", "200 Switching to ASCII mode."
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP command: Client
"74.231.146 .2", "PWD"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP response: Client
"74.231.146 .2", "257 "/634457502123""

And give me the correct answer, which is:

/intake/labels/redeye/634457502123

Bonus points for keeping track of the PID and the user, since many users
actions might be intermixed in the logs.

I realize I can do this with PHP string functions, but I'm wondering if
someone has already done it. Seems like it would be a lot of work to do
the script that I'm envisioning.

-- lawrence krubner

Are you looking to reconstruct the mkdir commands or the CD commands?

Sep 6 '08 #6

Nick S

On Sep 5, 8:19 pm, Lawrence Krubner <lawre...@krubn er.comwrote:

Curtis wrote:
lawrence k wrote:
I have to parse some FTP logs, which are full of several thousand
lines like this:

<log snipped>

When a file is uploaded, I need to reconstruct from this log what the
directory path is. Does anyone know if there is a PHP script that
someone has already written that does this?

Google might, but it's not too hard to do it yourself:

PHP standard string functions:
http://php.net/manual/en/ref.strings.php

PCRE (don't use POSIX regex, it's slower and deprecated):
http://php.net/manual/en/regexp.reference.php

I think you misunderstood me. I probably did not explain myself well.
What I want is a script that can take a few thousand lines that look
like this:

Thu Sep 4 11:39:04 2008 [pid 12977] [redeye] FTP command: Client
"74.231.146 .2", "TYPE A"
Thu Sep 4 11:39:04 2008 [pid 12977] [redeye] FTP response: Client
"74.231.146 .2", "200 Switching to ASCII mode."
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP command: Client
"74.231.146 .2", "PWD"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP response: Client
"74.231.146 .2", "257 "/intake""
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP command: Client
"74.231.146 .2", "CD labels"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP response: Client
"74.231.146 .2", "257 "/labels"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP command: Client
"74.231.146 .2", "CD redeye"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP response: Client
"74.231.146 .2", "257 "/redeye""
Thu Sep 4 11:39:04 2008 [pid 12977] [redeye] FTP response: Client
"74.231.146 .2", "200 Switching to ASCII mode."
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP command: Client
"74.231.146 .2", "PWD"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP response: Client
"74.231.146 .2", "257 "/634457502123""

And give me the correct answer, which is:

/intake/labels/redeye/634457502123

Bonus points for keeping track of the PID and the user, since many users
actions might be intermixed in the logs.

I realize I can do this with PHP string functions, but I'm wondering if
someone has already done it. Seems like it would be a lot of work to do
the script that I'm envisioning.

-- lawrence krubner

ok I'm assuming you just want to capture the CD commands. If so this
code should get you started.

<?php
$str = "Thu Sep 4 11:39:04 2008 [pid 12977] [redeye] FTP command:
Client \"74.231.146.2\ ", \"TYPE A\"
Thu Sep 4 11:39:04 2008 [pid 12977] [redeye] FTP response: Client
\"74.231.146.2\ ", \"200 Switching to ASCII mode.\"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP command: Client
\"74.231.146.2\ ", \"PWD\"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP command: Client
\"74.231.146.2\ ", \"CD intake\"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP response: Client
\"74.231.146.2\ ", \"257 \"/intake\"\"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP command: Client
\"74.231.146.2\ ", \"CD labels\"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP response: Client
\"74.231.146.2\ ", \"257 \"/labels\"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP command: Client
\"74.231.146.2\ ", \"CD redeye\"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP response: Client
\"74.231.146.2\ ", \"257 \"/redeye\"\"
Thu Sep 4 11:39:04 2008 [pid 12977] [redeye] FTP response: Client
\"74.231.146.2\ ", \"200 Switching to ASCII mode.\"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP command: Client
\"74.231.146.2\ ", \"PWD\"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP command: Client
\"74.231.146.2\ ", \"CD 634457502123\"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP response: Client
\"74.231.146.2\ ", \"257 \"/634457502123\"\ "";

//Use file("/path/to/file") to read the raw file into an array
$arrLines = explode("\n", $str);

$arrResults = array();
foreach ( $arrLines as $row )
{
preg_match_all ('/\[pid\s([0-9]+)\].*command\:.*CD \s(.*)"/si',
$row, $matches, PREG_SET_ORDER) ;

if ( is_array($match es[0]) )
{
$pid = $matches[0][1];
$dir = $matches[0][2];
$arrResults[$pid] .= "/" . $dir;
}
}

// To find out where pid 12952 went
print $arrResults[12952];

?>

What if they go back a directory and the into another. Do you need to
capture that as well?

Sep 6 '08 #7

Betikci Boris

On Sep 6, 3:37*am, Nick S <nrsut...@gmail .comwrote:

On Sep 5, 8:19 pm, Lawrence Krubner <lawre...@krubn er.comwrote:

Curtis wrote:
lawrence k wrote:
>I have to parse some FTP logs, which are full of several thousand
>lines like this:

<log snipped>

>When a file is uploaded, I need to reconstruct from this log what the
>directory path is. Does anyone know if there is a PHP script that
>someone has already written that does this?

Google might, but it's not too hard to do it yourself:

PHP standard string functions:
>http://php.net/manual/en/ref.strings.php

PCRE (don't use POSIX regex, it's slower and deprecated):
>http://php.net/manual/en/regexp.reference.php

I think you misunderstood me. I probably did not explain myself well.
What I want is a script that can take a few thousand lines that look
like this:

Thu Sep *4 11:39:04 2008 [pid 12977] [redeye] FTP command: Client
"74.231.146 .2", "TYPE A"
Thu Sep *4 11:39:04 2008 [pid 12977] [redeye] FTP response: Client
"74.231.146 .2", "200 Switching to ASCII mode."
Thu Sep *4 11:39:07 2008 [pid 12952] [redeye] FTP command: Client
"74.231.146 .2", "PWD"
Thu Sep *4 11:39:07 2008 [pid 12952] [redeye] FTP response: Client
"74.231.146 .2", "257 "/intake""
Thu Sep *4 11:39:07 2008 [pid 12952] [redeye] FTP command: Client
"74.231.146 .2", "CD labels"
Thu Sep *4 11:39:07 2008 [pid 12952] [redeye] FTP response: Client
"74.231.146 .2", "257 "/labels"
Thu Sep *4 11:39:07 2008 [pid 12952] [redeye] FTP command: Client
"74.231.146 .2", "CD redeye"
Thu Sep *4 11:39:07 2008 [pid 12952] [redeye] FTP response: Client
"74.231.146 .2", "257 "/redeye""
Thu Sep *4 11:39:04 2008 [pid 12977] [redeye] FTP response: Client
"74.231.146 .2", "200 Switching to ASCII mode."
Thu Sep *4 11:39:07 2008 [pid 12952] [redeye] FTP command: Client
"74.231.146 .2", "PWD"
Thu Sep *4 11:39:07 2008 [pid 12952] [redeye] FTP response: Client
"74.231.146 .2", "257 "/634457502123""

And give me the correct answer, which is:

/intake/labels/redeye/634457502123

Bonus points for keeping track of the PID and the user, since many users
* actions might be intermixed in the logs.

I realize I can do this with PHP string functions, but I'm wondering if
someone has already done it. Seems like it would be a lot of work to do
the script that I'm envisioning.

-- lawrence krubner

ok I'm assuming you just want to capture the CD commands. *If so this
code should get you started.

<?php
* * $str = "Thu Sep *4 11:39:04 2008 [pid 12977] [redeye] FTP command:
Client \"74.231.146.2\ ", \"TYPE A\"
Thu Sep *4 11:39:04 2008 [pid 12977] [redeye] FTP response: Client
\"74.231.146.2\ ", \"200 Switching to ASCII mode.\"
Thu Sep *4 11:39:07 2008 [pid 12952] [redeye] FTP command: Client
\"74.231.146.2\ ", \"PWD\"
Thu Sep *4 11:39:07 2008 [pid 12952] [redeye] FTP command: Client
\"74.231.146.2\ ", \"CD intake\"
Thu Sep *4 11:39:07 2008 [pid 12952] [redeye] FTP response: Client
\"74.231.146.2\ ", \"257 \"/intake\"\"
Thu Sep *4 11:39:07 2008 [pid 12952] [redeye] FTP command: Client
\"74.231.146.2\ ", \"CD labels\"
Thu Sep *4 11:39:07 2008 [pid 12952] [redeye] FTP response: Client
\"74.231.146.2\ ", \"257 \"/labels\"
Thu Sep *4 11:39:07 2008 [pid 12952] [redeye] FTP command: Client
\"74.231.146.2\ ", \"CD redeye\"
Thu Sep *4 11:39:07 2008 [pid 12952] [redeye] FTP response: Client
\"74.231.146.2\ ", \"257 \"/redeye\"\"
Thu Sep *4 11:39:04 2008 [pid 12977] [redeye] FTP response: Client
\"74.231.146.2\ ", \"200 Switching to ASCII mode.\"
Thu Sep *4 11:39:07 2008 [pid 12952] [redeye] FTP command: Client
\"74.231.146.2\ ", \"PWD\"
Thu Sep *4 11:39:07 2008 [pid 12952] [redeye] FTP command: Client
\"74.231.146.2\ ", \"CD 634457502123\"
Thu Sep *4 11:39:07 2008 [pid 12952] [redeye] FTP response: Client
\"74.231.146.2\ ", \"257 \"/634457502123\"\ "";

* * //Use file("/path/to/file") to read the raw file into an array
* * $arrLines = explode("\n", $str);

* * $arrResults = array();
* * foreach ( $arrLines as $row )
* * {
* * * * preg_match_all ('/\[pid\s([0-9]+)\].*command\:.*CD \s(.*)"/si',
$row, $matches, PREG_SET_ORDER) ;

* * * * if ( is_array($match es[0]) )
* * * * {
* * * * * * $pid = $matches[0][1];
* * * * * * $dir = $matches[0][2];
* * * * * * $arrResults[$pid] .= "/" . $dir;
* * * * }
* * }

* * // To find out where pid 12952 went
* * print $arrResults[12952];

?>

What if they go back a directory and the into another. *Do you need to
capture that as well?

After $arrLines = explode("\n", $str); explode it again with
whitespaces then store it in a db-table, it would be useful when its
necessary for later complex queries..

Sep 7 '08 #8

Nick S

On Sep 7, 5:47 pm, Betikci Boris <pard...@gmail. comwrote:

On Sep 6, 3:37 am, Nick S <nrsut...@gmail .comwrote:

On Sep 5, 8:19 pm, Lawrence Krubner <lawre...@krubn er.comwrote:

Curtis wrote:
lawrence k wrote:
I have to parse some FTP logs, which are full of several thousand
lines like this:

<log snipped>

When a file is uploaded, I need to reconstruct from this log what the
directory path is. Does anyone know if there is a PHP script that
someone has already written that does this?

Google might, but it's not too hard to do it yourself:

PHP standard string functions:
http://php.net/manual/en/ref.strings.php

PCRE (don't use POSIX regex, it's slower and deprecated):
http://php.net/manual/en/regexp.reference.php

I think you misunderstood me. I probably did not explain myself well.
What I want is a script that can take a few thousand lines that look
like this:

Thu Sep 4 11:39:04 2008 [pid 12977] [redeye] FTP command: Client
"74.231.146 .2", "TYPE A"
Thu Sep 4 11:39:04 2008 [pid 12977] [redeye] FTP response: Client
"74.231.146 .2", "200 Switching to ASCII mode."
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP command: Client
"74.231.146 .2", "PWD"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP response: Client
"74.231.146 .2", "257 "/intake""
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP command: Client
"74.231.146 .2", "CD labels"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP response: Client
"74.231.146 .2", "257 "/labels"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP command: Client
"74.231.146 .2", "CD redeye"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP response: Client
"74.231.146 .2", "257 "/redeye""
Thu Sep 4 11:39:04 2008 [pid 12977] [redeye] FTP response: Client
"74.231.146 .2", "200 Switching to ASCII mode."
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP command: Client
"74.231.146 .2", "PWD"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP response: Client
"74.231.146 .2", "257 "/634457502123""

And give me the correct answer, which is:

/intake/labels/redeye/634457502123

Bonus points for keeping track of the PID and the user, since many users
actions might be intermixed in the logs.

I realize I can do this with PHP string functions, but I'm wondering if
someone has already done it. Seems like it would be a lot of work to do
the script that I'm envisioning.

-- lawrence krubner

ok I'm assuming you just want to capture the CD commands. If so this
code should get you started.

<?php
$str = "Thu Sep 4 11:39:04 2008 [pid 12977] [redeye] FTP command:
Client \"74.231.146.2\ ", \"TYPE A\"
Thu Sep 4 11:39:04 2008 [pid 12977] [redeye] FTP response: Client
\"74.231.146.2\ ", \"200 Switching to ASCII mode.\"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP command: Client
\"74.231.146.2\ ", \"PWD\"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP command: Client
\"74.231.146.2\ ", \"CD intake\"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP response: Client
\"74.231.146.2\ ", \"257 \"/intake\"\"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP command: Client
\"74.231.146.2\ ", \"CD labels\"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP response: Client
\"74.231.146.2\ ", \"257 \"/labels\"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP command: Client
\"74.231.146.2\ ", \"CD redeye\"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP response: Client
\"74.231.146.2\ ", \"257 \"/redeye\"\"
Thu Sep 4 11:39:04 2008 [pid 12977] [redeye] FTP response: Client
\"74.231.146.2\ ", \"200 Switching to ASCII mode.\"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP command: Client
\"74.231.146.2\ ", \"PWD\"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP command: Client
\"74.231.146.2\ ", \"CD 634457502123\"
Thu Sep 4 11:39:07 2008 [pid 12952] [redeye] FTP response: Client
\"74.231.146.2\ ", \"257 \"/634457502123\"\ "";

//Use file("/path/to/file") to read the raw file into an array
$arrLines = explode("\n", $str);

$arrResults = array();
foreach ( $arrLines as $row )
{
preg_match_all ('/\[pid\s([0-9]+)\].*command\:.*CD \s(.*)"/si',
$row, $matches, PREG_SET_ORDER) ;

if ( is_array($match es[0]) )
{
$pid = $matches[0][1];
$dir = $matches[0][2];
$arrResults[$pid] .= "/" . $dir;
}
}

// To find out where pid 12952 went
print $arrResults[12952];

?>

What if they go back a directory and the into another. Do you need to
capture that as well?

After $arrLines = explode("\n", $str); explode it again with
whitespaces then store it in a db-table, it would be useful when its
necessary for later complex queries..

I tried that first but the pid has a space in it, that's why I went to
a regexp :)

Sep 7 '08 #9

Similar topics

1413

parsing windows event files

by: David Bear | last post by:

I did a cursory look at google but couldn't seem to find what I wanted. I need a script that can parse and create a proper record structure for windows event logs that are saved as tab delimited format. The event logs they produce seem unnecessarily complicated. Was hoping someone had already made something like this. I'd like to avoid using win32api.

Python

1146

Scripts for parsing Received: headers in emails

by: Benjamin Han | last post by:

A while ago I asked if anyone knows a module for parsing Received: headers in emails. Apparently my guess was wrong (that someone already wrote it in Python). I got an email pointing me to Spambayes project, however the tokenizer doesn't seem like doing a lot on the Received headers (especially when comparing to SpamAssassin's code). So I wrote a small set of scripts for doing this: ...

Python

3733

Running Python Scripts With 'sudo'

by: Tim Daneliuk | last post by:

Given that setuid is a Bad Thing for scripts, what is the general consensus here on running a Python script via 'sudo' to give it root system access? Is this reasonably secure, or am I still asking for trouble? TIA, -- ---------------------------------------------------------------------------- Tim Daneliuk tundra@tundraware.com PGP Key: http://www.tundraware.com/PGP/

Python

1943

Sql Scripts to Monitor another SQL Database.

by: Louis Frolio | last post by:

Greetings All, I was hoping that some of you might be aware of any free scripts that were written explicitly for the purpose of monitoring a SQL Server database. I want to be able to determine up/down events, Error Log updates, Long running Transactions, Deadlocks, etc. My plan is to use a central SQL Server database as a repository that will query (via t-sql) the target SQL Server boxes for the events listed above. If one of the events...

Microsoft SQL Server

1778

security: webhosted site and cgi-bin, scripts

by: sinister | last post by:

I have a site hosted by a commercial webhosting service. As such, I don't have any real control over the webserver (in this case, Apache). What are the most basic, essential elements of security in this case? My impression is that there are two steps: (1) binaries and scripts should be executable by the webserver, but not visible (readable) to the outside world; (2) when writing binaries and scripts, make sure that to constrain what...

HTML / CSS

4388

Calling WSH scripts from ASP

by: Bob | last post by:

I have created some WSH scripts on my Webserver that are executed by the Windows Task Scheduler. I want to be able to execute some of these scripts using a web interface and don't want to duplicate these scripts in ASP. I know this can be done using the WScript.Shell run method but I am having no success. Below is a test application I have thrown together to demonstrate my problem. If I run c:\intetpub\wwwroot\wshasp\storetime.vbs from...

ASP / Active Server Pages

2429

Tracing the execution of scripts?

by: Michael B. Trausch | last post by:

Alright, I seem to be at a loss for what I am looking for, and I am not even really all that sure if it is possible or not. I found the 'pdb' debugger, but I was wondering if there was something that would trace or log the order of line execution for a multi-module Python program. I am having a little bit of a problem tracking down a problem that I mentioned earlier (http://groups.google.com/group/comp.lang.python/msg/9c759fc888b365be),...

Python

1926

php scripts no longer working after upgrade

by: cwhite | last post by:

i recently upgraded from fedora core 5 to cent os 4.4 with php 4.3 mysql 4.1 and apache 2.0.52, and all of the php scripts i had which called specific entries from mysql are no longer working if i had a link display_story.php?id=334 it would know do display the entry which matched id 334, my code to display the entry looks like this <?php $Host="localhost";

PHP

1948

Parsing log in SQL DB to change IPs to hostnames

by: KDawg44 | last post by:

Hi, I am brand new to Python. In learning anything, I find it useful to actually try to write a useful program to try to tackle an actual problem. I have a syslog server and I would like to parse the syslog messages and try to change any ips to resolved hostnames. Unfortunately, I am not getting any matches on my regular expression.

Python

8354

The easy way to turn off automatic updates for Windows 10/11

by: Hystou | last post by:

Overview: Windows 11 and 10 have less user interface control over operating system update behaviour than previous versions of Windows. In Windows 11 and 10, there is no way to turn off the Windows Update option using the Control Panel or Settings app; it automatically checks for updates and installs any it finds, whether you like it or not. For most users, this new feature is actually very convenient. If you want to control the update process,...

Windows Server

8497

Discussion: How does Zigbee compare with other wireless protocols in smart home applications?

by: tracyyun | last post by:

Dear forum friends, With the development of smart home technology, a variety of wireless communication protocols have appeared on the market, such as Zigbee, Z-Wave, Wi-Fi, Bluetooth, etc. Each protocol has its own unique characteristics and advantages, but as a user who is planning to build a smart home system, I am a bit confused by the choice of these technologies. I'm particularly interested in Zigbee because I've heard it does some...

General

7182

AI Job Threat for Devs

by: agi2029 | last post by:

Let's talk about the concept of autonomous AI software engineers and no-code agents. These AIs are designed to manage the entire lifecycle of a software development project—planning, coding, testing, and deployment—without human intervention. Imagine an AI that can take a project description, break it down, write the code, debug it, and then launch it, all on its own.... Now, this would greatly impact the work of software developers. The idea...

Career Advice

6116

Access Europe - Using VBA to create a class based on a table - Wed 1 May

by: isladogs | last post by:

The next Access Europe User Group meeting will be on Wednesday 1 May 2024 starting at 18:00 UK time (6PM UTC+1) and finishing by 19:30 (7.30PM). In this session, we are pleased to welcome a new presenter, Adolph Dupré who will be discussing some powerful techniques for using class modules. He will explain when you may want to use classes instead of User Defined Types (UDT). For example, to manage the data in unbound forms. Adolph will...

Microsoft Access / VBA

5570

Couldn’t get equations in html when convert word .docx file to html file in C#.

by: conductexam | last post by:

I have .net C# application in which I am extracting data from word file and save it in database particularly. To store word all data as it is I am converting the whole word file firstly in HTML and then checking html paragraph one by one. At the time of converting from word file to html my equations which are in the word document file was convert into image. Globals.ThisAddIn.Application.ActiveDocument.Select();...

C# / C Sharp

4089

Trying to create a lan-to-lan vpn between two differents networks

by: TSSRALBI | last post by:

Hello I'm a network technician in training and I need your help. I am currently learning how to create and manage the different types of VPNs and I have a question about LAN-to-LAN VPNs. The last exercise I practiced was to create a LAN-to-LAN VPN between two Pfsense firewalls, by using IPSEC protocols. I succeeded, with both firewalls in the same network. But I'm wondering if it's possible to do the same thing, with 2 Pfsense firewalls...

Networking - Hardware / Configuration

4192

Windows Forms - .Net 8.0

by: adsilva | last post by:

A Windows Forms form does not have the event Unload, like VB6. What one acts like?

Visual Basic .NET

2621

transfer the data from one system to another through ip address

by: 6302768590 | last post by:

Hai team i want code for transfer the data from one system to another through IP address by using C# our system has to for every 5mins then we have to update the data what the data is updated we have to send another system

C# / C Sharp

1499

Comprehensive Guide to Website Development in Toronto: Expert Insights from BSMN Consultancy

by: bsmnconsultancy | last post by:

In today's digital era, a well-designed website is crucial for businesses looking to succeed. Whether you're a small business owner or a large corporation in Toronto, having a strong online presence can significantly impact your brand's success. BSMN Consultancy, a leader in Website Development in Toronto offers valuable insights into creating effective websites that not only look great but also perform exceptionally well. In this comprehensive...

General