#!/usr/bin/perl use strict; use warnings; use File::Find; use DateTime; use Getopt::Std; use DateTime::Format::HTTP; use Data::Dumper; use File::ReadBackwards qw(); my (@apache_confs,@log_paths,@tmp); my $start_point = "/etc/apache2/sites-enabled"; my $conf_ext = ".conf"; my ($second, $minute, $hour, $day, $month, $year, $weekday, $dayofyear, $isDST) = localtime(time); $year += 1900; $month++; my $log_date = 'DateTime::Format::HTTP'; my %options = (); my %source_ip = (); my %referrers= (); my %urls = (); my %agents =(); getopts ('d:r:' => \%options); die "No time range duration object defined" if !$options{'d'}; die "No time range defined for back tracing." if !$options{'r'}; my $now = DateTime->new(year => $year, month => $month, day => $day, hour => $hour, minute => $minute, second => $second); my $start_time = $now->clone->subtract( $options{'d'} => $options{'r'} ); print "Start from: $start_time Now: $now\n"; my ($line,$source_host,$my_host,$internal_redirect,$date,$url_with_method,$status,$size,$referrer,$agent,$end_time,$check_time,$vhost_name); finddepth(\&stat, $start_point); sub stat { my ($log_path); my $apache_configs_found = scalar(@apache_confs); open (F, "<","$File::Find::name") and push @apache_confs, "$File::Find::name" && print "$File::Find::name FOUND apache configs COUNT: $apache_configs_found \n" if m/$conf_ext/; while () { chomp; s/(\s)//g; s/#.*//; next if /^(\s)*$/; if (/CustomLog/) { $log_path = $_; $log_path =~ s/CustomLog//; $log_path =~ s/combined//; push @log_paths, $log_path; print "Logpath $log_path\n"; } } close(F); foreach (@log_paths) { my $fh_in = File::ReadBackwards->new($_) or die("Unable to open \"$_\": $!\n"); while (defined($line = $fh_in->readline())) { chomp($line); print "$line|\n"; ($source_host,$my_host,$internal_redirect,$date,$url_with_method,$status,$size,$referrer,$agent) = $line =~ m@^(\S+?), (\S+) (\S+) - - \[(\d{2})/(\w+)/(\d{4}):\s*(\d{2}):(\d{2}):\s*(\d{2}) \+(\d{4})\] ".*?" (\d{3}) (\d+) "(.*?)" "(.*?)"@; print Data::Dumper->Dump( [ \$line, \$source_host,\$my_host,\$internal_redirect,\$date,\$url_with_method,\$status,\$size,\$referrer,\$agent ], [qw(*line *source_host *my_host *internal_redirect *date *url_with_method *status *size *referrer *agent)], ), qq{\n}; $date =~ s/\[//g; $date =~ s/\]//g; eval { $check_time = $log_date->parse_datetime($date)}; my $cmp = DateTime->compare( $check_time, $start_time ); next if $cmp >= 0 ; print "CMP$cmp STIME:$check_time SH:$source_host, MH:$my_host, IR:$internal_redirect, D:$date, U:$url_with_method, S:$status, SZ:$size, R:$referrer, A:$agent\n"; $source_ip{$source_host}++; $referrers{$referrer}++; $urls{$url_with_method}++; $agents{$agent}++; } }