readlog_squid.c

   1 /*
   2  * SARG Squid Analysis Report Generator      http://sarg.sourceforge.net
   3  *                                                            1998, 2015
   4  *
   5  * SARG donations:
   6  *      please look at http://sarg.sourceforge.net/donations.php
   7  * Support:
   8  *     http://sourceforge.net/projects/sarg/forums/forum/363374
   9  * ---------------------------------------------------------------------
  10  *
  11  *  This program is free software; you can redistribute it and/or modify
  12  *  it under the terms of the GNU General Public License as published by
  13  *  the Free Software Foundation; either version 2 of the License, or
  14  *  (at your option) any later version.
  15  *
  16  *  This program is distributed in the hope that it will be useful,
  17  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19  *  GNU General Public License for more details.
  20  *
  21  *  You should have received a copy of the GNU General Public License
  22  *  along with this program; if not, write to the Free Software
  23  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111, USA.
  24  *
  25  */
  26
  27 #include "include/conf.h"
  28 #include "include/defs.h"
  29 #include "include/readlog.h"
  30
  31 /*!
  32 A new file is being read. The name of the file is \a FileName.
  33 */
  34 static void Squid_NewFile(const char *FileName)
  35 {
  36 }
  37
  38 /*!
  39 Read one entry from a standard squid log format.
  40
  41 \param Line One line from the input log file.
  42 \param Entry Where to store the information parsed from the line.
  43
  44 \retval RLRC_NoError One valid entry is parsed.
  45 \retval RLRC_Unknown The line is invalid.
  46 \retval RLRC_InternalError An internal error was encountered.
  47 */
  48 static enum ReadLogReturnCodeEnum Squid_ReadEntry(char *Line,struct ReadLogStruct *Entry)
  49 {
  50         const char *Begin;
  51         time_t log_time;
  52         int IpLen;
  53         int HttpCodeLen;
  54         int HttpMethodLen;
  55         int UrlLen;
  56         int UserLen;
  57         struct tm *tt;
  58         char *Ip;
  59         char *User;
  60
  61         // get log time.
  62         Begin=Line;
  63         log_time=0;
  64         while (isdigit(*Line)) log_time=log_time*10+(*Line++-'0');
  65         if (*Line!='.' || Line==Begin) return(RLRC_Unknown);
  66
  67         // ignore decimal part to log time.
  68         Begin=++Line;
  69         while (isdigit(*Line)) Line++;
  70         if (*Line!=' ' || Line==Begin) return(RLRC_Unknown);
  71
  72         // skip spaces before the elapsed time.
  73         while (*Line==' ') Line++;
  74
  75         // get the elapsed time.
  76         Begin=Line;
  77         Entry->ElapsedTime=0L;
  78         if (*Line=='-')
  79         {
  80                 /*
  81                  * Negative elapsed time happens in squid (see
  82                  * http://www.squid-cache.org/mail-archive/squid-users/200711/0192.html)
  83                  * but no answer were provided as to why it happens. Let's just
  84                  * assume a zero elapsed time and ignore every following digit.
  85                  */
  86                 Line++;
  87                 if (!isdigit(*Line)) return(RLRC_Unknown);
  88                 while (isdigit(*Line)) Line++;
  89         }
  90         else
  91         {
  92                 if (!isdigit(*Line)) return(RLRC_Unknown);
  93                 while (isdigit(*Line)) Entry->ElapsedTime=Entry->ElapsedTime*10+(*Line++-'0');
  94         }
  95         if (*Line!=' ' || Line==Begin) return(RLRC_Unknown);
  96
  97         // get IP address. It can be a fqdn if that option is enabled in squid.
  98         Entry->Ip=Ip=++Line;
  99         for (IpLen=0 ; *Line && *Line!=' ' ; IpLen++) Line++;
 100         if (*Line!=' ' || IpLen==0) return(RLRC_Unknown);
 101
 102         // get the HTTP code.
 103         Entry->HttpCode=++Line;
 104         for (HttpCodeLen=0 ; *Line && *Line!=' ' ; HttpCodeLen++) Line++;
 105         if (*Line!=' ' || HttpCodeLen==0) return(RLRC_Unknown);
 106
 107         // get the number of transfered bytes.
 108         Begin=++Line;
 109         Entry->DataSize=0LL;
 110         while (isdigit(*Line)) Entry->DataSize=Entry->DataSize*10+(*Line++-'0');
 111         if (*Line!=' ' || Begin==Line) return(RLRC_Unknown);
 112
 113         // get the HTTP method
 114         Entry->HttpMethod=++Line;
 115         for (HttpMethodLen=0 ; *Line && *Line!=' ' ; HttpMethodLen++) Line++;
 116         if (*Line!=' '|| HttpMethodLen==0) return(RLRC_Unknown);
 117
 118         // the url
 119         Entry->Url=++Line;
 120         for (UrlLen=0 ; *Line && *Line!=' ' ; UrlLen++) Line++;
 121         if (*Line!=' ' || UrlLen==0) return(RLRC_Unknown);
 122
 123         // the ID of the user or - if the user is unidentified
 124         Entry->User=User=++Line;
 125         for (UserLen=0 ; *Line && *Line!=' ' ; UserLen++) Line++;
 126         if (*Line!=' ' || UserLen==0) return(RLRC_Unknown);
 127
 128         // now, the format is known with a good confidence. If the time doesn't decode, it is an error.
 129         tt=localtime(&log_time);
 130         if (tt==NULL) {
 131                 debuga(__FILE__,__LINE__,_("Cannot convert the timestamp from the squid log file\n"));
 132                 return(RLRC_InternalError);
 133         }
 134         memcpy(&Entry->EntryTime,tt,sizeof(struct tm));
 135
 136         // it is safe to alter the line buffer now that we are returning a valid entry
 137         Ip[IpLen]='\0';
 138         Entry->HttpCode[HttpCodeLen]='\0';
 139         Entry->HttpMethod[HttpMethodLen]='\0';
 140         Entry->Url[UrlLen]='\0';
 141         User[UserLen]='\0';
 142
 143         return(RLRC_NoError);
 144 }
 145
 146 //! \brief Object to read a standard squid log format.
 147 const struct ReadLogProcessStruct ReadSquidLog=
 148 {
 149         /* TRANSLATORS: This is the name of the log format displayed when this format is detected in an input log file. */
 150         N_("squid log format"),
 151         Squid_NewFile,
 152         Squid_ReadEntry
 153 };