]>
Commit | Line | Data |
---|---|---|
1c91da07 FM |
1 | /* |
2 | * SARG Squid Analysis Report Generator http://sarg.sourceforge.net | |
110ce984 | 3 | * 1998, 2015 |
1c91da07 FM |
4 | * |
5 | * SARG donations: | |
6 | * please look at http://sarg.sourceforge.net/donations.php | |
7 | * Support: | |
8 | * http://sourceforge.net/projects/sarg/forums/forum/363374 | |
9 | * --------------------------------------------------------------------- | |
10 | * | |
11 | * This program is free software; you can redistribute it and/or modify | |
12 | * it under the terms of the GNU General Public License as published by | |
13 | * the Free Software Foundation; either version 2 of the License, or | |
14 | * (at your option) any later version. | |
15 | * | |
16 | * This program is distributed in the hope that it will be useful, | |
17 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
18 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
19 | * GNU General Public License for more details. | |
20 | * | |
21 | * You should have received a copy of the GNU General Public License | |
22 | * along with this program; if not, write to the Free Software | |
23 | * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111, USA. | |
24 | * | |
25 | */ | |
26 | ||
27 | #include "include/conf.h" | |
28 | #include "include/defs.h" | |
f83d7b44 | 29 | #include "include/readlog.h" |
1c91da07 FM |
30 | |
31 | /*! | |
32 | A new file is being read. The name of the file is \a FileName. | |
33 | */ | |
34 | static void Squid_NewFile(const char *FileName) | |
35 | { | |
36 | } | |
37 | ||
38 | /*! | |
39 | Read one entry from a standard squid log format. | |
40 | ||
41 | \param Line One line from the input log file. | |
42 | \param Entry Where to store the information parsed from the line. | |
43 | ||
44 | \retval RLRC_NoError One valid entry is parsed. | |
45 | \retval RLRC_Unknown The line is invalid. | |
46 | \retval RLRC_InternalError An internal error was encountered. | |
47 | */ | |
48 | static enum ReadLogReturnCodeEnum Squid_ReadEntry(char *Line,struct ReadLogStruct *Entry) | |
49 | { | |
50 | const char *Begin; | |
51 | time_t log_time; | |
52 | int IpLen; | |
53 | int HttpCodeLen; | |
8b4e9578 | 54 | int HttpMethodLen; |
1c91da07 FM |
55 | int UrlLen; |
56 | int UserLen; | |
cb53374b | 57 | struct tm *tt; |
f83d7b44 FM |
58 | char *Ip; |
59 | char *User; | |
bd43d81f | 60 | |
1c91da07 FM |
61 | // get log time. |
62 | Begin=Line; | |
63 | log_time=0; | |
64 | while (isdigit(*Line)) log_time=log_time*10+(*Line++-'0'); | |
65 | if (*Line!='.' || Line==Begin) return(RLRC_Unknown); | |
bd43d81f | 66 | |
1c91da07 FM |
67 | // ignore decimal part to log time. |
68 | Begin=++Line; | |
69 | while (isdigit(*Line)) Line++; | |
70 | if (*Line!=' ' || Line==Begin) return(RLRC_Unknown); | |
bd43d81f | 71 | |
1c91da07 FM |
72 | // skip spaces before the elapsed time. |
73 | while (*Line==' ') Line++; | |
bd43d81f | 74 | |
1c91da07 FM |
75 | // get the elapsed time. |
76 | Begin=Line; | |
77 | Entry->ElapsedTime=0L; | |
7ab27b70 FM |
78 | if (*Line=='-') |
79 | { | |
80 | /* | |
81 | * Negative elapsed time happens in squid (see | |
82 | * http://www.squid-cache.org/mail-archive/squid-users/200711/0192.html) | |
83 | * but no answer were provided as to why it happens. Let's just | |
84 | * assume a zero elapsed time and ignore every following digit. | |
85 | */ | |
86 | Line++; | |
87 | if (!isdigit(*Line)) return(RLRC_Unknown); | |
88 | while (isdigit(*Line)) Line++; | |
89 | } | |
90 | else | |
91 | { | |
92 | if (!isdigit(*Line)) return(RLRC_Unknown); | |
93 | while (isdigit(*Line)) Entry->ElapsedTime=Entry->ElapsedTime*10+(*Line++-'0'); | |
94 | } | |
1c91da07 FM |
95 | if (*Line!=' ' || Line==Begin) return(RLRC_Unknown); |
96 | ||
97 | // get IP address. It can be a fqdn if that option is enabled in squid. | |
f83d7b44 | 98 | Entry->Ip=Ip=++Line; |
1c91da07 FM |
99 | for (IpLen=0 ; *Line && *Line!=' ' ; IpLen++) Line++; |
100 | if (*Line!=' ' || IpLen==0) return(RLRC_Unknown); | |
101 | ||
102 | // get the HTTP code. | |
103 | Entry->HttpCode=++Line; | |
104 | for (HttpCodeLen=0 ; *Line && *Line!=' ' ; HttpCodeLen++) Line++; | |
105 | if (*Line!=' ' || HttpCodeLen==0) return(RLRC_Unknown); | |
106 | ||
107 | // get the number of transfered bytes. | |
108 | Begin=++Line; | |
109 | Entry->DataSize=0LL; | |
110 | while (isdigit(*Line)) Entry->DataSize=Entry->DataSize*10+(*Line++-'0'); | |
111 | if (*Line!=' ' || Begin==Line) return(RLRC_Unknown); | |
bd43d81f | 112 | |
8b4e9578 FM |
113 | // get the HTTP method |
114 | Entry->HttpMethod=++Line; | |
115 | for (HttpMethodLen=0 ; *Line && *Line!=' ' ; HttpMethodLen++) Line++; | |
116 | if (*Line!=' '|| HttpMethodLen==0) return(RLRC_Unknown); | |
bd43d81f | 117 | |
1c91da07 FM |
118 | // the url |
119 | Entry->Url=++Line; | |
120 | for (UrlLen=0 ; *Line && *Line!=' ' ; UrlLen++) Line++; | |
121 | if (*Line!=' ' || UrlLen==0) return(RLRC_Unknown); | |
bd43d81f | 122 | |
1c91da07 | 123 | // the ID of the user or - if the user is unidentified |
f83d7b44 | 124 | Entry->User=User=++Line; |
1c91da07 FM |
125 | for (UserLen=0 ; *Line && *Line!=' ' ; UserLen++) Line++; |
126 | if (*Line!=' ' || UserLen==0) return(RLRC_Unknown); | |
bd43d81f | 127 | |
1c91da07 | 128 | // now, the format is known with a good confidence. If the time doesn't decode, it is an error. |
cb53374b FM |
129 | tt=localtime(&log_time); |
130 | if (tt==NULL) { | |
1c91da07 FM |
131 | debuga(_("Cannot convert the timestamp from the squid log file\n")); |
132 | return(RLRC_InternalError); | |
133 | } | |
cb53374b | 134 | memcpy(&Entry->EntryTime,tt,sizeof(struct tm)); |
bd43d81f | 135 | |
1c91da07 | 136 | // it is safe to alter the line buffer now that we are returning a valid entry |
f83d7b44 | 137 | Ip[IpLen]='\0'; |
1c91da07 | 138 | Entry->HttpCode[HttpCodeLen]='\0'; |
8b4e9578 | 139 | Entry->HttpMethod[HttpMethodLen]='\0'; |
1c91da07 | 140 | Entry->Url[UrlLen]='\0'; |
f83d7b44 | 141 | User[UserLen]='\0'; |
bd43d81f | 142 | |
1c91da07 FM |
143 | return(RLRC_NoError); |
144 | } | |
145 | ||
146 | //! \brief Object to read a standard squid log format. | |
147 | const struct ReadLogProcessStruct ReadSquidLog= | |
148 | { | |
149 | /* TRANSLATORS: This is the name of the log format displayed when this format is detected in an input log file. */ | |
150 | N_("squid log format"), | |
151 | Squid_NewFile, | |
152 | Squid_ReadEntry | |
153 | }; |