一個用Perl分析Apache Log的簡單程序..

apile

發信用的Email..會將純文字的文件寄送出去...

1. 
   
2. #!/usr/bin/perl
   
3. #---------------------------------------------------------------
   
4. #fileName: mail_perl:發送測試用的Email
   
5. #---------------------------------------------------------------
   
6. use Mail::Sender;
   
7. ## 幫助Debug使用
   
8. use Carp();
   
9. local $SIG{__WARN__} = \&Carp::cluck;
   
10. ## 將Standard Error儲存至檔案
    
11. open(STDERR,">;>;/tmp/mail_err.log");
    
12. 
    
13. #local($to,$subject,$filename,$from,$server_ip,$replyto) =@_;
    
14. ## 取得輸入參數
    
15. $to=shift;
    
16. $subject = shift;
    
17. $filename=shift;
    
18. $filename=~/(\/.*\/)(.*)/;
    
19. ## 取得附加檔名
    
20. $file= $2;
    
21. $from=shift;
    
22. $server_ip=shift;
    
23. $replyto= shift;
    
24. $fake_from =shift;
    
25. 
    
26. #print "$to,$subject,$filename,$from,$server_ip,$replyto\n";
    
27. 
    
28. # 定義smtp server，client是從哪來的
    
29. ref($sender = new Mail::Sender {
    
30.           smtp =>; "$server_ip",
    
31.           client =>; '10.1.1.1',
    
32.           boundary=>; 'this-is-a-mail-boundary-435427' })
    
33.     or die "Error in mailing: $Mail::Sender::Error\n";
    
34. # 開啟multi part的object，定義to,from,fake_from,charset,replyto,subject等變數
    
35. $sender->;OpenMultipart({to=>;"$to",
    
36.                       from =>;"$from",
    
37.                       fake_from =>; "$fake_from",
    
38.                       charset=>;'Big5',
    
39.                       replyto =>;"$replyto",
    
40.                       subject =>; "$subject"});
    
41. # 寫內文
    
42. $sender->;Body({charset=>;'big5',ctype=>;'text/plain'});
    
43. $sender->;Send(<<"*END*");
    
44. 這是一封由系統自動告知信件，請查收..謝謝您!!!
    
45. --------------------
    
46. *END*
    
47. # 開始附加檔案部分，先要瞭解附加檔案是什麼型態，
    
48. # 本範例是純文字檔，所以ctype使用的是text/plain，如果是gif要使用image/gif
    
49. # ，dispositiion會影響user看到的檔案名稱，如果有/xx/xx/ttt.txt會顯示成
    
50. # _xx_xx_ttt.txt ，"_"會被替代成"/"
    
51. $sender->;Attach({ description=>;"$file",
    
52.          ctype=>;'text/plain',
    
53.          disposition=>;"attachment;filename=$file",
    
54.          file=>;"$filename"
    
55.         })
    
56.         || die "Error in attachment: $Mail::Sender::Error\n";
    
57. $sender->;Close;
    

复制代码

產生前一天日期的代碼

1. 
   
2. #!/usr/bin/perl
   
3. # fileName: predate
   
4. my %mon=(
   
5.   1 =>; "Jan",  2 =>; "Feb",  3 =>; "Mar",  4 =>; "Apr",
   
6.   5 =>; "May",  6 =>; "Jun",  7 =>; "Jul",  8 =>; "Aug",
   
7.   9 =>; "Sep",  10 =>; "Oct",  11 =>; "Nov",  12 =>; "Dec"
   
8. );
   
9. my ($sec1,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst)=localtime(time-86400);
   
10.    $mon++;
    
11.    $mon=$mon{$mon};
    
12.    $mday = sprintf("%02s",$mday);
    
13.    $hour = sprintf("%02s",$hour);
    
14.    $min = sprintf("%02s",$min);
    
15.    $sec = sprintf("%02s",$sec);
    
16.    $year+=1900;
    
17. print "$mday/$mon/$year\n";
    

复制代码

前一天登錄超過五百次者，將他的IP Address記錄下來...
由大到小排序

1. 
   
2. #!/usr/bin/perl
   
3. # check_apache.pl
   
4. while(<>;){
   
5.   chomp;
   
6.   $aa{$_}++;
   
7. }
   
8. open (FF,">;/apile/record.txt");
   
9. my($predate)=`/apile/predate`;
   
10. chomp($predate);
    
11. print FF "------- APACHE 登錄檔記錄------------\r\n";
    
12. print FF "--紀錄日期：$predate      登錄筆數大於500筆者\r\n";
    
13. print FF "---------------------------------------------\r\n";
    
14. for (reverse sort { $aa{$a}<=>;$aa{$b}} keys %aa){
    
15.   if( $aa{$_} >; 500){
    
16.      print FF "$_ =>; $aa{$_} \r\n";
    
17.   }
    
18. }
    
19. print FF "---------------------------------------------\r\n";
    
20. close(FF);
    

复制代码

1. 
   
2. #!/usr/bin/ksh
   
3. # check_apache.sh
   
4. PATH=/usr/bin:/sbin:/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin
   
5. export PATH
   
6. Date=`/apile/predate`
   
7. echo "cat /usr/local/apache/logs/access_log|grep $Date | awk '{printf("%s\n",$1)}'|
   
8. /apile/check_apache.pl"
   
9. cat /usr/local/apache/log/access_log|grep "$Date" | awk '{printf("%s\n",$1)}'|/apile/check_apache.pl
   
10. 
    
11. /apile/mail_perl "apile@abc.cde" " APACHE登錄檔檢查每日定時回報" "/apile/record.txt" "apile@abc.cde" "10.2.2.2" "apile@abc.cde" "FAKEMAIL@fake.fake"
    

复制代码

使用方式：crontab -e
00 17 * * 0-5 /apile/check_apache.sh 1>;/tmp/apache.log 2>;/tmp/apache.err


Email附件如下：(record.txt)

-------APACHE 登錄檔記錄------------
--紀錄日期：17/Aug/2003      登錄筆數大於500筆者
---------------------------------------------
10.1.17.80 =>; 1848
10.1.17.65 =>; 1834
10.1.17.66 =>; 1607
10.1.17.85 =>; 1403
10.1.17.51 =>; 1345
10.1.17.52 =>; 1027
10.1.17.84 =>; 860
10.1.17.54 =>; 849
10.1.17.86 =>; 690
10.1.17.81 =>; 674
10.1.17.50 =>; 655
10.1.17.64 =>; 619
10.1.17.69 =>; 619
10.1.17.67 =>; 593
10.1.17.83 =>; 575
10.1.17.57 =>; 512
10.1.17.55 =>; 505
-------------------------------------------

這只是簡單的記錄那個IP Address登錄了幾次...
功能不完整，但還可以用，因為最近我維護的系統
不穩定，就讓我用這個程序抓到有人在三天內連接
了超過5萬次..讓我的系統非常不穩定..

deathcult

Good，感谢Apile提供宝贵的工作经验! ：）

wuhanzhou

哥们给我介绍一本APACHE的书吧！

apile

http://linux.vbird.org/
書喔..我不清楚..:)
我都上google..搜尋出來的..
上面這個網站..有篇WWW簡易設定...
可以看看...

deanej

呵呵，我是用sendmail直接发的将一些日志作为附加发送。

1. 
   
2. #!/usr/bin/perl
   
3. my $access;
   
4. my $log_file;
   
5. my $error_file;
   
6. open (ACCESS,"/home/deanej/logs/access.txt") || die "Can't open file";
   
7. foreach  (<ACCESS>;) {
   
8.   $access.= $_;
   
9. }
   
10. close (ACCESS);
    
11. open (LOG_FILE,"/home/deanej/logs/log_file.txt") || die "Can't open file";
    
12. foreach  (<LOG_FILE>;) {
    
13. $log_file.=$_;
    
14. }
    
15. close (LOG_FILE);
    
16. open (ERROR_FILE,"/home/deanej/logs/error_file.txt") || die "Can't open file";
    
17. foreach  (<ERROR_FILE>;) {
    
18.    $error_file.=$_;
    
19. }
    
20. close (ERROR_FILE);
    
21. open (MAIL,"|/usr/sbin/sendmail -t") || die "can't exec sendmail";
    
22. $old=select(MAIL);
    
23. print<<"EOF";
    
24. TO:aa\@localhost
    
25. From:aa\@aa.com
    
26. Subject:Log file
    
27. Mime-Version: 1.0
    
28. Content-Type: multipart/mixed;
    
29.         boundary="----=_Part_702668_3668633.1015131391343"
    
30. 
    
31. ------=_Part_702668_3668633.1015131391343
    
32. Content-Type: text/plain; charset=gb2312
    
33. Content-Transfer-Encoding: 8bit
    
34. Content-Disposition:inline
    
35. 
    
36. $access;
    
37. ------=_Part_702668_3668633.1015131391343
    
38. Content-Type:text/plain; name=log_file.txt
    
39. Content-Transfer-Encoding: 8bit
    
40. Content-Disposition: attachment; filename=log_file.txt
    
41. 
    
42. $log_file;
    
43. ------=_Part_702668_3668633.1015131391343
    
44. Content-Type:text/plain; name=error_file.txt
    
45. Content-Transfer-Encoding: 8bit
    
46. Content-Disposition: attachment; filename=error_file.txt
    
47. 
    
48. $error_file;
    
49. 
    
50. 
    
51. ------=_Part_702668_3668633.1015131391343--
    
52. EOF
    
53. select($old);
    

复制代码

apile

因為我的主機上面沒有sendmail..只能借助公司的mail
server...:)
這樣子就不需要去研究複雜的SendMail了...