Skip to content

Instantly share code, notes, and snippets.

@sharifulin
Created May 27, 2009 14:44
Show Gist options
  • Save sharifulin/118677 to your computer and use it in GitHub Desktop.
Save sharifulin/118677 to your computer and use it in GitHub Desktop.
Simple parse proftpd log
#!/usr/bin/perl
use utf8;
use strict;
use lib '../../lib';
use common;
my $LOG = '/var/log/proftpd.log';
my $TMP = '/tmp/***/proftpd.tmp'; unlink $TMP if @ARGV;
my $M = {May => 5, Jun => 6, Jul => 7, Aug => 8, Sep => 9, Oct => 10, Nov => 11, Dec => 12, Jan => 1, Feb => 2, Mar => 3, Apr => 4};
my $count;
open my $fh, '-|', "logtail -f $LOG -o $TMP" or die "Can't open pipe: $!";
while (<$fh>) {
my $r; @$r{'ip', 'login', 'day', 'month', 'year', 'time', 'tz', 'id', 'cmd', 'code', 'size'} = m{
.*
:
( \d+ (?: \. \d+ ) {3} )
\s+
( \S+ )
\s+
\[
( \d+ ) / ( \w+ ) / ( \d+ )
:
(\S+)
\s+
(.*?)
\]
\s+
( \S+ )
\s+
" ( .*? ) "
\s+
( \S+ )
\s+
( \S+ )
}x;
next unless $r->{'cmd'} =~ /USER|STOR|ABOR|DELE/;
# fix
$r->{'login' } = $r->{'cmd'} =~ /USER (\w+)/ ? $1 : $r->{'login'};
$r->{'size' } = $r->{'size'} eq '-' ? 0 : $r->{'size'} / 1024 / 1024;
$r->{'date' } = sprintf "%04d-%02d-%02d %s", $r->{'year'}, $M->{$r->{'month'}}, $r->{'day'}, $r->{'time'};
$r->{'_tz' } = $r->{'tz'} eq '+0000' ? 4 : 0; # hack: bad log date format
$r->{'status'} = $r->{'code'} =~ /^2|3/ ? 'ok' : 'error';
#
$DB->query(
'insert into upload_log set ip=?, login=?, uid=?, cmd=?, code=?, size=?, status=?, created=? + interval ? hour',
@$r{'ip', 'login', 'id', 'cmd', 'code', 'size', 'status', 'date', '_tz'}
);
$count++;
}
print $count;
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment