From: Willy Tarreau <w@1wt.eu>
Date: Sun, 10 Jul 2011 15:27:40 +0000 (+0200)
Subject: [MINOR] halog: add support for HTTP log matching (-H)
X-Git-Tag: v1.5-dev8~196
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=70c428f7c61906f82786c17d19b4e9f9959bb4f3;p=thirdparty%2Fhaproxy.git

[MINOR] halog: add support for HTTP log matching (-H)

Now it's possible to restrict analysis to HTTP-looking logs when passing -H.
-H -v gives the opposite (most likely TCP logs).
---

diff --git a/contrib/halog/halog.c b/contrib/halog/halog.c
index a6635167c5..6478981047 100644
--- a/contrib/halog/halog.c
+++ b/contrib/halog/halog.c
@@ -101,6 +101,8 @@ struct url_stat {
 #define FILT_COUNT_URL_ANY   (FILT_COUNT_URL_ONLY|FILT_COUNT_URL_COUNT|FILT_COUNT_URL_ERR| \
 			      FILT_COUNT_URL_TTOT|FILT_COUNT_URL_TAVG|FILT_COUNT_URL_TTOTO|FILT_COUNT_URL_TAVGO)
 
+#define FILT_HTTP_ONLY       0x200000
+
 unsigned int filter = 0;
 unsigned int filter_invert = 0;
 const char *line;
@@ -112,7 +114,7 @@ void die(const char *msg)
 	fprintf(stderr,
 		"%s"
 		"Usage: halog [-q] [-c] [-v] {-gt|-pct|-st|-tc|-srv|-u|-uc|-ue|-ua|-ut|-uao|-uto}\n"
-		"       [-s <skip>] [-e|-E] [-rt|-RT <time>] [-ad <delay>] [-ac <count>] < file.log\n"
+		"       [-s <skip>] [-e|-E] [-H] [-rt|-RT <time>] [-ad <delay>] [-ac <count>] < log\n"
 		"\n",
 		msg ? msg : ""
 		);
@@ -439,6 +441,8 @@ int main(int argc, char **argv)
 			filter |= FILT_ERRORS_ONLY;
 		else if (strcmp(argv[0], "-E") == 0)
 			filter |= FILT_ERRORS_ONLY | FILT_INVERT_ERRORS;
+		else if (strcmp(argv[0], "-H") == 0)
+			filter |= FILT_HTTP_ONLY;
 		else if (strcmp(argv[0], "-c") == 0)
 			filter |= FILT_COUNT_ONLY;
 		else if (strcmp(argv[0], "-q") == 0)
@@ -497,6 +501,28 @@ int main(int argc, char **argv)
 		linenum++;
 
 		test = 1;
+		if (unlikely(filter & FILT_HTTP_ONLY)) {
+			/* only report lines with at least 4 timers */
+			b = field_start(line, TIME_FIELD + skip_fields);
+			if (!*b) {
+				truncated_line(linenum, line);
+				continue;
+			}
+
+			e = field_stop(b + 1);
+			/* we have field TIME_FIELD in [b]..[e-1] */
+
+			p = b;
+			err = 0;
+			f = 0;
+			while (!sep[(unsigned char)*p]) {
+				if (++f == 4)
+					break;
+				SKIP_CHAR(p, '/');
+			}
+			test &= (f >= 4);
+		}
+
 		if (unlikely(filter & FILT_TIME_RESP)) {
 			int tps;