#!/usr/local/bin/perl
use Time::Local 'timelocal';
use PerlIO::gzip;
use IO::Tee;
use IO::File;

$err = 0;
$help = 1 if($ARGV[0] eq '-h');
$help = 1 if($ARGV[0] eq '--help');
$help = 1 if($ARGV[0] eq '-help');
$help = 1 if($ARGV[0] eq '');
$debug = 1 if($ARGV[0] eq '-d');

$msgHelp = "FORMAT - command [-d][-h][--help] Month StartDate EndDate\n\tStart & End Date = mm/dd/yyyy";
$msgGreps = "\n----------------------The following greps will be used for searching:\n";
$msgFiles = "\n----------------------The following files will be searched based on the dates given:\n";
$msgStarting = "\n----------------------Now Starting\n";


if($help == 1){
	print $msgHelp;
} elsif($debug == 1){
	$month = $ARGV[1]; 
	@start = split /\//, $ARGV[2];
	@end = split /\//, $ARGV[3];
}else{
	$month = $ARGV[0]; 
	@start = split /\//, $ARGV[1];
	@end = split /\//, $ARGV[2];
}

$inputpath = "/logs/";
$startdate = timelocal(0,0,0, $start[1], $start[0]-1, $start[2]-1900);
$enddate = timelocal(0,0,0, $end[1]+1, $end[0]-1, $end[2]-1900);
$currenttime = localtime time;
$fcount = 1;
$gcount = 0;

if($debug !=1){$logfile = "win_greplog.txt" }else{$logfile = "testlogfile.txt"};
$msgstarting = "\n----------------------$currenttime-----------------------\nParse will start with logs dated: startdate = $startdate\nEnding with logs dated: enddate  = $enddate\nIn the following directory: $inputpath\n";
$tee = new IO::Tee(\*STDOUT, new IO::File(">>$logfile"));

print $tee "\nDEBUG MODE ON" if($debug == 1);
print $tee $msgstarting;

opendir INPUTDIR, $inputpath;
	@inputfiles = grep {	(stat "$inputpath/$_")[9] >= $startdate and (stat "$inputpath/$_")[9] < $enddate } readdir INPUTDIR;
closedir INPUTDIR; 
$numfiles = @inputfiles;

$greps[0]  = '\SOFTWARE\Microsoft\Windows\CurrentVersion\Run';
$greps[1]  = '\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce';
$greps[2]  = '\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx';
$greps[3]  = '\SOFTWARE\Microsoft\Windows\CurrentVersion\AeDebug';
$greps[4]  = '\SYSTEM\CurrentControlSet\Control\SessionManager\KnownDLLs';
$greps[5]  = '\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg';
$greps[6]  = '\SOFTWARE\inAgents\EventLog2Syslog';
$greps[7]  = '%systemdrive%';
$greps[8]  = 'C:\';
$greps[9]  = '\system32';
$greps[10] = '\system32\drivers';
$greps[11] = '\system32\config';
$greps[12] = '\system32\spool';
$greps[13] = '\repair';

print $tee $msgGreps;
foreach $gname (@greps) {
	print $tee "\n - greps[$gcount]\t $gname";
	$gcount++;
}

print $tee $msgFiles;
foreach $filelist (@inputfiles) {
	$filelist = $inputpath.$filelist;
	print $tee "\n - $filelist";
}

print $tee $msgStarting;
# step into each input file
foreach $inputfile (@inputfiles) {
	# step into each grep
	$gcount = 0;
	foreach $grep (@greps) {
		# build the outputfile
		$outputfile = $month."_".$gcount."_".$inputfile."_results.txt";
		@results = `zgrep $grep > $outputfile`;
		$gcount++;
	}
}

print $tee "\n\n----------------------Normal Completion\n" if ($err==0);

close(LOGFILE);