######################################
# 數據文件的格式如下:
#Software: Microsoft(R) Internet Security and Acceleration Server 2000
#Version: 1.0
#Date: 2005-10-13 00:00:05
#Fields: c-ip cs-username c-agent sc-authenticated date time s-svcname s-computername cs-referred r-host r-ip r-port time-taken cs-bytes sc-bytes cs-protocol cs-transport s-operation cs-uri cs-mime-type s-object-source sc-status s-cache-info rule#1 rule#2
10.5.1.163 anonymous Mozilla/4.0(compatible; MSIE 6.0; Windows NT 5.0) N 2005-10-13 00:00:05 w3proxy SZFTP - - - - - 268 - - TCP GET http://promos.hotbar.com/promos/promodll.dll?GetPromo&El=&SG=&RAND=13406&partner=hbtools&/p.gif - - 12209 0x0 - -
10.5.1.163 anonymous Mozilla/4.0(compatible; MSIE 6.0; Windows NT 5.0) N 2005-10-13 00:00:05 w3proxy SZFTP - - - - - 372 - - TCP GET http://promos.hotbar.com/promos/promodll.dll?GetPromo&El=&SG=&RAND=13406&partner=hbtools&/p.gif - - 0 0x0 - -
10.5.1.163 YAHSINjinghua.lei Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0) Y 2005-10-13 00:00:05 w3proxy SZFTP - - - - - 528 - - TCP GET http://promos.hotbar.com/promos/promodll.dll?GetPromo&El=&SG=&RAND=13406&partner=hbtools&/p.gif - - 12209 0x0 - -
10.7.64.31 yahsindanny.sun Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; MSN Messenger7.0.0777) Y 2005-10-13 00:00:23 w3proxy SZFTP - 207.46.3.11 207.46.3.11 80 188 281 355 http TCP POST http://207.46.3.11/gateway/gateway.dll?Action=poll&SessionID=468608173.14050 application/x-msn-messenger Inet 200 0x40000004 all Allow rule
10.5.1.163 anonymous Mozilla/4.0(compatible; MSIE 6.0; Windows NT 5.0) N 2005-10-13 00:00:40 w3proxy SZFTP - - - - - 268 - - TCP GET http://promos.hotbar.com/promos/promodll.dll?GetPromo&El=&SG=&RAND=99396&partner=hbtools&/p.gif - - 12209 0x0 - -
10.5.1.163 anonymous Mozilla/4.0(compatible; MSIE 6.0; Windows NT 5.0) N 2005-10-13 00:00:40 w3proxy SZFTP - - - - - 372 - - TCP GET http://promos.hotbar.com/promos/promodll.dll?GetPromo&El=&SG=&RAND=99396&partner=hbtools&/p.gif - - 0 0x0 - -
#######################################
需要安裝python和Karrigell，
#######################################
# 第一個文件:
# index.py
import os
import datetime
workdir = "z:/"
os.chdir(workdir)
###############################################################
# Get LOG file list
file_list = []
date_list = []
file_list.append("file name")
date_list.append("date time")
for f in os.listdir(workdir):
if f[0:3] == "WEB":
file_list.append(f)
date_list.append(f[7:15])
###############################################################
# generate HTML Head
print """
|
"""
###############################################################
# generate HTML Body
print "
| " , date_list[0] , " | "" , file_list[0] , " |
| " | " , file_list[x] , " |
##############################################################
# generate HTML Tail
a = datetime.datetime.today().isoformat(' ')
b = string.split(a," ")
print """
Generate Date: """ print b[0],b[1] print """ |
Power By : Python Script |
| connect: |
"""
del file_list
del date_list
del a,b
######################## END File ########################
# 第二個文件:t1.py
#import cStringIO
import sys
import re
import string
import datetime
import os
from os.path import join
##############################################################
# Analisys information
workdir = 'z:/'
os.chdir(workdir)
fn = string.strip(QUERY["file_name"])
filename = workdir + fn
input = sys.stdin
input = open(filename)
#input = open("z:/WEB.log")
ip_list = []
user_list = []
url_list = []
#tver = ""
#tdate = ""
#tsoft = ""
for line in input.readlines():
list1 = line.split("")
if len(list1) > 1:
if list1[0][0:6] == "#Field":
ip_list.append("Client IP")
user_list.append("Account Name")
url_list.append("URL List")
else:
if (list1[0] not in ip_list) or (list1[1] not in user_list):
ip_list.append(list1[0])
user_list.append(list1[1])
url_list.append(list1[18])
else:
if line[0:4] == "#Sof":
tsoft = line
elif line[0:4] == "#Ver":
tver = line
elif line[0:4] == "#Dat":
tdate = line
input.close()
###############################################################################
# Generate HTML Head
print "
print "
print "
print "
###############################################################################
# Generate HTML Body
print """
Client IP | Account Name | URL List |
| " |
##############################################################
# generate HTML Tail
a = datetime.datetime.today().isoformat(' ')
b = string.split(a," ")
print """
Generate Date: """ print b[0],b[1] print """ |
Power By : Python Script |
| connect: |
"""
######################## Del variable ########################
#ip_list = []
#user_list = []
#url_list = []
del tver , tdate , tsoft , a , b
######################## END File ########################
# 第三個文件 filter.py
import os
import sys
import re
import datetime
workdir = 'z:/'
os.chdir(workdir)
fn = string.strip(QUERY["fn"])
filename = workdir + fn
ip_list = []
user_list = []
url_list = []
t_in = 0
t_out = 0
t_total = 0
#############################################################################
def grep_ip(ip):
t_in = 0
t_out = 0
t_total = 0
input = sys.stdin
input = open(filename)
#input = open("z:/WEB.log")
for line in input.readlines():
list1 = line.split("")
if len(list1) > 1:
if list1[0][0:6] == "#Field":
ip_list.append("Client IP")
user_list.append("Account Name")
url_list.append("URL List")
else:
if list1[0] == ip:
ip_list.append(list1[0])
user_list.append(list1[1])
url_list.append(list1[18])
if list1[13] != "-":
t_out = t_out + int(list1[13])
if list1[14] != "-":
t_in = t_in + int(list1[14])
t_total = t_total + t_out + t_in
else:
if line[0:4] == "#Sof":
tsoft = line
elif line[0:4] == "#Ver":
tver = line
elif line[0:4] == "#Dat":
tdate = line
input.close()
#print ip_list
#############################################################################
#
def grep_name(username):
t_in = 0
t_out = 0
t_total = 0
input = sys.stdin
input = open(filename)
#input = open("z:/WEB.log")
for line in input.readlines():
list1 = line.split("")
if len(list1) > 1:
if list1[0][0:6] == "#Field":
ip_list.append("Client IP")
user_list.append("Account Name")
url_list.append("URL List")
else:
if list1[1] == username:
ip_list.append(list1[0])
user_list.append(list1[1])
url_list.append(list1[18])
if list1[13] != "-":
t_out = t_out + int(list1[13])
if list1[14] != "-":
t_in = t_in + int(list1[14])
t_total = t_total + t_out + t_in
else:
if line[0:4] == "#Sof":
tsoft = line
elif line[0:4] == "#Ver":
tver = line
elif line[0:4] == "#Dat":
tdate = line
input.close()
#print user_list
######################## Generate HTML ##########################
def generate_html():
#### generate HTML Head
print """
|
"""
#### generate HTML Body
print """
Client IP | Account Name | URL List |
| " |
#### generate HTML Tail
a = datetime.datetime.today().isoformat(' ')
b = string.split(a," ")
print """
Generate Date: """ print b[0],b[1] print """ |
Power By : Python Script |
| connect: |
"""
#############################################################################
if QUERY.has_key("c_ip"):
tip = string.strip(QUERY["c_ip"])
ttype = string.strip(QUERY["type"])
grep_ip(tip)
generate_html()
if QUERY.has_key("uname"):
tun = string.strip(QUERY["uname"])
ttype = string.strip(QUERY["type"])
grep_name(tun)
generate_html()
ip_list = []
user_list = []
url_list = []
###############################################################################
還想添加一些功能,如前十名網站,前十名用戶,異常用戶,異常使用記錄等.
還要等幾天才行.