Skip to content

Instantly share code, notes, and snippets.

@mah-nyan
Last active Apr 13, 2019
Embed
What would you like to do?
WOWHoneypotのaccess_logよりcsvを作成するpython3スクリプトです。
# -*- coding: utf-8 -*-
#WOWHoneypotのaccess_logよりcsvを作成するpython3スクリプトです。
#2019-04-13 mah-nyan
import sys
import os
import re
import csv
args = sys.argv
def create_csv(arg1):
try:
csvdata = [["date", "time", "src_ip", "method", "path"]]
log_file = open("./" + arg1)
lines = log_file.readlines()
log_file.close
for line in lines:
date = re.search ("\d{4}-\d{2}-\d{2}", line)
time = re.search ("\d{2}:\d{2}:\d{2}", line)
srcip = re.search ("]\s\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}", line)
method = re.search ("(?<=\s\")\w+", line)
uri = re.search ("\s/\s|\s(/[\w\$\&\?\(\)\.\+\-\\\|\[\]\^=~/%#:;',<>@{}]+)(?=\sHTTP/\d\.\d\")", line)
uri2 = re.search ("\s(\w+[\w\$\&\?\(\)\.\+\-\\\|\[\]\^=~/%#:;',<>@{}]+)(?=\sHTTP/\d\.\d\")", line)
uri3 = re.search ("\s\s(?=HTTP/\d\.\d\")", line)
if uri is not None:
rawuri = str(uri.group()).lstrip( )
rawsrcip = str(srcip.group())
csvdata += [[date.group(), time.group(), rawsrcip.replace("] ", ""), method.group(), rawuri]]
if uri2 is not None:
rawuri2 = str(uri2.group()).lstrip( )
rawsrcip = str(srcip.group())
csvdata += [[date.group(), time.group(), rawsrcip.replace("] ", ""), method.group(), rawuri2]]
if uri3 is not None:
rawuri3 = str(uri3.group()).lstrip( )
rawsrcip = str(srcip.group())
csvdata += [[date.group(), time.group(), rawsrcip.replace("] ", ""), method.group(), rawuri3]]
if not os.path.exists("./log/"):
os.mkdir("./log/")
with open('./log/' + arg1 + ".csv", "w") as file:
writer = csv.writer(file, lineterminator='\n')
writer.writerows(csvdata)
return csvdata
except Exception as e:
csvdata += [["e", "rr", "o", "r", str(e)]]
with open('./log/' + arg1 + ".csv", "w") as file:
writer = csv.writer(file, lineterminator='\n')
writer.writerows(csvdata)
print (str(e))
return csvdata
if __name__ == '__main__':
if len(args) <= 1:
print("引数に対象のaccess_logを指定して下さい。")
else:
print(args[1] + "のdataを読み込みます。\n")
csvdata = create_csv(args[1])
print('./log/' + args[1] + ".csvを作成しました。")
@mah-nyan
Copy link
Author

mah-nyan commented Apr 11, 2019

2019-04-11 pathが無い場合も取得できるように対応しました。

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment