parent
06d7b1d253
commit
c7d4537241
1 changed files with 0 additions and 110 deletions
@ -1,110 +0,0 @@ |
||||
#!/usr/bin/perl -w |
||||
|
||||
use warnings; |
||||
use strict; |
||||
use JSON; |
||||
|
||||
my $result = { |
||||
users => {}, |
||||
machines => {}, |
||||
operations => { |
||||
connect => 0, |
||||
disconnect => 0, |
||||
chdir => 0, |
||||
open_read => 0, |
||||
open_write => 0, |
||||
close => 0, |
||||
rename => 0, |
||||
unlink => 0, |
||||
mkdir => 0, |
||||
rmdir => 0 |
||||
}, |
||||
files => {}, |
||||
status => { |
||||
success => 0, |
||||
failure => 0 |
||||
} |
||||
}; |
||||
|
||||
my $re_date = qr/(?<month>\w{3})\s(?<day>\d{1,2})\s(?<hour>[\d+]{1,2}):(?<minute>\d{1,2}):(?<seconds>\d{1,2})/; |
||||
my $re_hostname = qr/\w[\w\-]+/; |
||||
my $re_user = qr/\w[\w\-]+/; |
||||
my $re_op = qr/connect|disconnect|chdir|open|close|rename|unlink|mkdir|rmdir/; |
||||
my $re_path = qr{/?(\.|([^\|]/?)*)}; |
||||
my $re_ip = qr/(\d{1,3}\.){3}\d{1,3}/; |
||||
my $re_share = qr/\w[\w\-]+/; |
||||
my $re_status = qr/ok|fail\s+[^\|]+/; |
||||
|
||||
while (<STDIN>){ |
||||
chomp; |
||||
# Jan 13 03:50:42 contis smbd[27251]: pdurant|192.168.137.117|desk-magasin|tools|close |
||||
next unless m/^$re_date\s+$re_hostname\s+smbd\[\d+\]:\s+(?<user>$re_user)\|(?<ip>$re_ip)\|(?<machine>$re_hostname)\|(?<share>$re_share)\|(?<operation>$re_op)\|(?<status>$re_status)\|/; |
||||
my $date = $+{date}; |
||||
my $user = $+{user}; |
||||
my $ip = $+{ip}; |
||||
my $machine = $+{machine}; |
||||
my $share = $+{share}; |
||||
my $operation = $+{operation}; |
||||
my $status = $+{status}; |
||||
my $open_mode; |
||||
my $file = ''; |
||||
my $new_name; |
||||
if ($operation eq 'open'){ |
||||
m/(r|w)\|(?<file>$re_path)$/; |
||||
$open_mode = $1; |
||||
$file = $+{file}; |
||||
if ($open_mode eq 'r'){ |
||||
$result->{operations}->{open_read}++; |
||||
} else { |
||||
$result->{operations}->{open_write}++; |
||||
} |
||||
} elsif ($operation eq 'rename') { |
||||
m/(?<file>$re_path)\|(?<new_name>$re_path)$/; |
||||
$file = $+{file}; |
||||
$new_name = $+{new_name}; |
||||
$result->{operations}->{rename}++; |
||||
} elsif ($operation =~ m/(dis)?connect/){ |
||||
$result->{operations}->{$operation}++; |
||||
}else { |
||||
m/(?<file>$re_path)$/; |
||||
$file = $+{file}; |
||||
$result->{operations}->{$operation}++; |
||||
} |
||||
$result->{machines}->{$machine}++; |
||||
$result->{ip}->{$ip}++; |
||||
# Skip machine account, do not count it as a user action |
||||
$result->{users}->{$user}++ unless ($user =~ m/_$/); |
||||
$result->{files}->{$share . '/' . $file}++ unless ($file =~ m{^/}); |
||||
if ($status eq 'ok'){ |
||||
$result->{status}->{success}++; |
||||
} else { |
||||
$result->{status}->{failure}++; |
||||
} |
||||
} |
||||
|
||||
$result->{distinct} = { |
||||
users => scalar keys %{$result->{users}}, |
||||
machines => scalar keys %{$result->{machines}}, |
||||
ip => scalar keys %{$result->{ip}}, |
||||
files => scalar keys %{$result->{files}}, |
||||
}; |
||||
|
||||
$result->{top10} = { |
||||
users => get_top($result->{users}), |
||||
machines => get_top($result->{machines}), |
||||
ip => get_top($result->{ip}), |
||||
files => get_top($result->{files}), |
||||
operations => get_top($result->{operations}) |
||||
}; |
||||
|
||||
print to_json($result, { pretty => 1}); |
||||
|
||||
sub get_top { |
||||
my $hash = shift; |
||||
my $res = []; |
||||
foreach my $item (sort { $hash->{$b} <=> $hash->{$a} } keys %{$hash}){ |
||||
push @{$res}, $item . " ($hash->{$item})"; |
||||
last if (scalar(@{$res}) ge 010); |
||||
} |
||||
return $res; |
||||
} |
Loading…
Reference in new issue