leech-detector

   1 #!/usr/bin/perl
   2 # leech-detector -- analyze logs on stdin and print a summary on stdout
   3 # Copyright (C) 2004  Alex Schroeder <alex@emacswiki.org>
   4 #
   5 # This program is free software; you can redistribute it and/or modify
   6 # it under the terms of the GNU General Public License as published by
   7 # the Free Software Foundation; either version 2 of the License, or
   8 # (at your option) any later version.
   9 #
  10 # This program is distributed in the hope that it will be useful,
  11 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  12 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13 # GNU General Public License for more details.
  14 #
  15 # You should have received a copy of the GNU General Public License
  16 # along with this program; if not, write to the
  17 #    Free Software Foundation, Inc.
  18 #    59 Temple Place, Suite 330
  19 #    Boston, MA 02111-1307 USA
  20 #
  21 # $Id: leech-detector,v 1.1 2004/07/09 06:39:32 as Exp $</p>'
  22
  23 use Time::ParseDate;
  24 while (<STDIN>) {
  25   m/^(\S+) \S+ \S+ \[(.*?)\] ".*?" (\d+)/ or die "Cannot parse:\n$_";
  26   $ip = $1;
  27   $code = $3;
  28   $time = parsedate($2);
  29   $count{$ip}++;
  30   $first{$ip} = $time unless $first{$ip};
  31   $last{$ip} = $time;
  32   $status{$ip} = () unless exists $status{$ip};
  33   $status{$ip}{$code}++;
  34   $total++;
  35 }
  36 @result = sort {$count{$b} <=> $count{$a}} keys %count;
  37 foreach $ip (@result) {
  38   $avg = 0;
  39   if ($first{$ip} and $last{$ip} and $count{$ip} > 1) {
  40     $avg = ($last{$ip} - $first{$ip}) / ($count{$ip} -1);
  41   }
  42   printf "%20s %10d %3d%% %7s  %s\n", $ip, $count{$ip},
  43     100 * $count{$ip} / $total,
  44       $avg ? sprintf('%.1fs', $avg) : '',
  45         join(', ', map { sprintf("%3d (%d%%)",
  46                                  $_,
  47                                  100 * $status{$ip}{$_} / $count{$ip})
  48                        } sort { $status{$ip}{$b} <=> $status{$ip}{$a} } keys %{$status{$ip}});
  49 }