Parses bind query logs to determine queries per second.

parsebind.pl

#!/usr/bin/perl
 
#use Date::Parse;
use Time::ParseDate;
 
my $line_num = 0;
my $first_line = 0;
my $oldest_record = 0;
my $line = '';
my $date = 0;

my $max_rate = 0.0;
my $min_rate = 9999999.0;
 
my %query_counter = {};
my @abbr = qw( Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec );
 
while (<>) {
        chomp;
        $line = $_;
 
        #my ($date, $time, $ip, $hostname, $in, $type, $crap) = $line  =~ m/^([\d]{2}-[\w]{3}-[\d]{4}) ([\d]{2}:[\d]{2}:[\d]{2}\.[\d]{3}) client ([\d\.]+)#[\d]*: [\w]+: ([\w\d\.]+) ([\w]+) ([\w]+) ([.]*)/;
        if ($line =~ m/^([\d]{2}-[\w]{3}-[\d]{4}) ([\d]{2}:[\d]{2}:[\d]{2}\.[\d]{3}) client ([\d\.]+)#[\d]*: [\w]+: ([\w\d\.]+) ([\w]+) ([\w]+) ([.]*)/) {
                $date = parsedate("$1 $2");
#               print "$1 $2 => $date\n";
                if ($oldest_record == 0) {
                        $oldest_record = $date;
                        $first_line = $line_num;
                        print "First line:\t$line_num\tdate\t".localtime($date)."\n";
                }
                my ($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime($date);
                $year += 1900;
                $mon += 1;
                my $key = $year . '-' . sprintf('%02d',$mon) . '-' . sprintf('%02d',$mday). ' '.sprintf('%02d',$hour).':00 to '.sprintf('%02d',$hour).':59' ;
 
                if ($query_counter{$key}) {
                        $query_counter{$key}++;
                } else {
                        $query_counter{$key} = 1;
                }
        }
        $line_num++;
}
 
print "Last line:\t$line_num\tdate\t".localtime($date)."\n";
 
my $elapsed = $date - $oldest_record;
my $net_records = $line_num - $first_line;
my $rate = ($net_records * 1.0) / $elapsed;
 
print "Rate for $elapsed seconds: ".sprintf('%0.2f',$rate)." per second\n";
print "\n\n";

foreach my $key (sort keys %query_counter) {
        $rate = ($query_counter{$key} * 1.0) / 3600;
        if ($rate > $max_rate) {
                $max_rate = $rate;
        } 
        if ($rate > 0 && $rate < $min_rate) {
                $min_rate = $rate;
        }
}
 
my $stars = 30;
my $star_factor = int($stars / $max_rate);

foreach my $key (sort keys %query_counter) {
        $rate = ($query_counter{$key} * 1.0) / 3600;
        print "$key => $query_counter{$key}, rate ".sprintf('%0.3f',$rate)." queries/sec\t";
        for ($i = 0; $i < ($star_factor * $rate); $i++) {
                print '*';
        }
        print "\n";
}
 
exit 0;

parsebind2.pl

#!/usr/bin/perl
 
#use Date::Parse;
use Time::ParseDate;
 
my $line_num = 0;
my $first_line = 0;
my $oldest_record = 0;
my $line = '';
my $date = 0;
 
my %query_counter = {};
my @abbr = qw( Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec );
 
while (<>) {
	chomp;
	$line = $_;
 
	#my ($date, $time, $ip, $hostname, $in, $type, $crap) = $line  =~ m/^([\d]{2}-[\w]{3}-[\d]{4}) ([\d]{2}:[\d]{2}:[\d]{2}\.[\d]{3}) client ([\d\.]+)#[\d]*: [\w]+: ([\w\d\.]+) ([\w]+) ([\w]+) ([.]*)/;
	if ($line =~ m/^([\d]{2}-[\w]{3}-[\d]{4}) ([\d]{2}:[\d]{2}:[\d]{2}\.[\d]{3}) client ([\d\.]+)#[\d]*: [\w]+: ([\w\d\.]+) ([\w]+) ([\w]+) ([.]*)/) {
		$date = parsedate("$1 $2");
		my ($domain) = ($4 =~ m/([\w\d\-]+\.[\w]+)$/);
		$domain = lc($domain);
#		print "$1 $2 => $date\n";
		if ($oldest_record == 0) {
			$oldest_record = $date;
			$first_line = $line_num;
			print "First line:\t$line_num\tdate\t".localtime($date)."\n";
		}
		my ($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime($date);
		$year += 1900;
		$mon += 1;
		my $key = $domain .' '.$year . '-' . sprintf('%02d',$mon) . '-' . sprintf('%02d',$mday). ' '.sprintf('%02d',$hour).':00 to '.sprintf('%02d',$hour).':59' ;
 
		if ($query_counter{$key}) {
			$query_counter{$key}++;
		} else {
			$query_counter{$key} = 1;
		}
	}
	$line_num++;
}
 
print "Last line:\t$line_num\tdate\t".localtime($date)."\n";
 
my $elapsed = $date - $oldest_record;
my $net_records = $line_num - $first_line;
my $rate = ($net_records * 1.0) / $elapsed;
 
print "Rate for $elapsed seconds: ".sprintf('%0.2f',$rate)." per second\n";
print "\n\n";
 
foreach my $key (sort keys %query_counter) {
	$rate = ($query_counter{$key} * 1.0) / 3600;
	print "$key => $query_counter{$key}, rate ".sprintf('%0.3f',$rate)." queries/sec\n";
}
 
exit 0;