[SQU] FYI: A simple perl module for parsing Squid log files

Hi all:
   Was intending to put this out a lot sooner..(sigh)..anyway..
This module is part of the work that I did for rolling my own log file
parser.. its in Perl, and (I think) the interface is fairly simple...
Unfortunately, I've found that a lot of tools don't do exactly what I
wanted, so this was part of the result, for better or worse...

Small test script is also found in here (ltest.pl)... that shows
example usage of the module..
all this module does (for now) is return squid access log lines in
either a hash or list...
also included is a little include script called "dateparser.pl"
you can use the module and the include script to find out things
such as,
"give me all the entries for IP x within the past 10 minutes/
hour/day.."

oh, btw, dateparser.pl requires Date::Manip to be installed, but
nothing more outside the standard distribution is needed...

Thimal

#!/usr/bin/perl

use Squidlog;

my $sl = new Squidlog;
$sl->check_filename('c:/tja/distro/source/access.log');
$name = $sl->check_filename;
print "The real name is $name\n";
$sl->check_type('squid');
print "The type is " . $sl->check_type . "\n";
print "The version is " . $sl->get_version. "\n";
$ret_val = $sl->load_file;
if(defined $ret_val) { print "OK\n"; }
else { print "Not ok\n"; }
$counter = 0;
#while($counter < 15) { $counter++; $line = $sl->get_array_elements; map { print} @$line; }
@ref = ('timestamp','cache busy time','IP address','TCP code/HTTP','Size of document','ACTION','URL','blank','director','mime type');
#$sl->check_metadata(\@ref);
while($counter < 300) { $rl = $sl->get_hash_elements; $counter++;}
%e = %$rl;
foreach $elem(keys %e) { print "$elem : $e{$elem} \n"; }--Message-Boundary-17122
Content-type: text/plain; charset=US-ASCII
Content-disposition: inline
Content-description: Attachment information.

The following section of this message contains a file attachment
prepared for transmission using the Internet MIME message format.
If you are using Pegasus Mail, or any another MIME-compliant system,
you should be able to save it or view it from within your mailer.
If you cannot, please ask your system administrator for assistance.

   ---- File information -----------
     File: squidlog.pm
     Date: 28 Feb 2001, 12:55
     Size: 3993 bytes.
     Type: Unknown

#!/usr/bin/perl

package DateParser;

use Date::Manip;
sub date_mangler {
        $arg = $_[0];
        $times = $_[1];
        $seconds_gm = time();
        $some_day = localtime($seconds_gm);
        $parsed=&ParseDate($some_day);
        $epoch = &UnixDate($parsed,"%s");
        if(not defined $times) { $times = 1; }
        if(not defined $arg) { $arg = 'default'; }

        if(($arg eq '-min') or ($arg eq '-MIN')){
                $epoch -= ($times *60);
        }
        elsif(($arg eq '-hour') or ($arg eq '-HOUR')){
                $epoch -= ($times * 3600);
        }
        elsif(($arg eq '-day') or ($arg eq '-DAY')){
                $epoch -= ($times * 86400);
        }
        else {
                $epoch -= 86400;
        }
        return $epoch;
}
1;

--
To unsubscribe, see http://www.squid-cache.org/mailing-lists.html