note
clmcshque
Thanks graff, I used your suggestion, and this is waht I came up with, does it look right? Or are there some improvements I could make.
Since this is only my second week with perl I am open to suggestions!
<code>
#!/usr/local/bin/perl
use Time::Local 'timelocal';
use PerlIO::gzip;
use IO::Tee;
use IO::File;
$err = 0;
$help = 1 if($ARGV[0] eq '-h');
$help = 1 if($ARGV[0] eq '--help');
$help = 1 if($ARGV[0] eq '-help');
$help = 1 if($ARGV[0] eq '');
$debug = 1 if($ARGV[0] eq '-d');
$msgHelp = "FORMAT - command [-d][-h][--help] Month StartDate EndDate\n\tStart & End Date = mm/dd/yyyy";
$msgGreps = "\n----------------------The following greps will be used for searching:\n";
$msgFiles = "\n----------------------The following files will be searched based on the dates given:\n";
$msgStarting = "\n----------------------Now Starting\n";
if($help == 1){
print $msgHelp;
} elsif($debug == 1){
$month = $ARGV[1];
@start = split /\//, $ARGV[2];
@end = split /\//, $ARGV[3];
}else{
$month = $ARGV[0];
@start = split /\//, $ARGV[1];
@end = split /\//, $ARGV[2];
}
$inputpath = "/logs/";
$startdate = timelocal(0,0,0, $start[1], $start[0]-1, $start[2]-1900);
$enddate = timelocal(0,0,0, $end[1]+1, $end[0]-1, $end[2]-1900);
$currenttime = localtime time;
$fcount = 1;
$gcount = 0;
if($debug !=1){$logfile = "win_greplog.txt" }else{$logfile = "testlogfile.txt"};
$msgstarting = "\n----------------------$currenttime-----------------------\nParse will start with logs dated: startdate = $startdate\nEnding with logs dated: enddate = $enddate\nIn the following directory: $inputpath\n";
$tee = new IO::Tee(\*STDOUT, new IO::File(">>$logfile"));
print $tee "\nDEBUG MODE ON" if($debug == 1);
print $tee $msgstarting;
opendir INPUTDIR, $inputpath;
@inputfiles = grep { (stat "$inputpath/$_")[9] >= $startdate and (stat "$inputpath/$_")[9] < $enddate } readdir INPUTDIR;
closedir INPUTDIR;
$numfiles = @inputfiles;
$greps[0] = '\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';
$greps[1] = '\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce';
$greps[2] = '\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx';
$greps[3] = '\SOFTWARE\Microsoft\Windows\CurrentVersion\AeDebug';
$greps[4] = '\SYSTEM\CurrentControlSet\Control\SessionManager\KnownDLLs';
$greps[5] = '\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg';
$greps[6] = '\SOFTWARE\inAgents\EventLog2Syslog';
$greps[7] = '%systemdrive%';
$greps[8] = 'C:\';
$greps[9] = '\system32';
$greps[10] = '\system32\drivers';
$greps[11] = '\system32\config';
$greps[12] = '\system32\spool';
$greps[13] = '\repair';
print $tee $msgGreps;
foreach $gname (@greps) {
print $tee "\n - greps[$gcount]\t $gname";
$gcount++;
}
print $tee $msgFiles;
foreach $filelist (@inputfiles) {
$filelist = $inputpath.$filelist;
print $tee "\n - $filelist";
}
print $tee $msgStarting;
# step into each input file
foreach $inputfile (@inputfiles) {
# step into each grep
$gcount = 0;
foreach $grep (@greps) {
# build the outputfile
$outputfile = $month."_".$gcount."_".$inputfile."_results.txt";
@results = `zgrep $grep > $outputfile`;
$gcount++;
}
}
print $tee "\n\n----------------------Normal Completion\n" if ($err==0);
close(LOGFILE);
</code>
538316
538419