vpnstats.pl 4.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125
  1. #!/usr/bin/perl -w
  2. use strict;
  3. #
  4. # vpnstats - generate list of VPN connections from PPTP+PPP log messages
  5. # copyright (C) 2002 Scott Merrill (skippy@skippy.net)
  6. #
  7. # usage: vpnstats /var/log/messages
  8. #
  9. # version 1.4 09-09-2003
  10. # - thanks to Masaya Miyamoto (miyamo@po.ntts.co.jp)
  11. # and David Fuzishima (david_f@zipmail.com.br) for fixing the
  12. # date/time regexes to catch single-digit days (9 instead of 09).
  13. #
  14. # version 1.3
  15. # - thanks to Andy Behrens <andy.behrens@coat.com> for
  16. # fixing up the regex to catch extraneous whitespace, and
  17. # domain names that inlucde numbers and underscores.
  18. # - I modified the output to report when a user is still connected
  19. # - thanks to Wolfgang Powisch for fixing hostnames included a "-"
  20. #
  21. # This program is free software; you can redistribute it and/or
  22. # modify it under the terms of the GNU General Public License
  23. # as published by the Free Software Foundation; either version 2
  24. # of the License, or (at your option) any later version.
  25. #
  26. # This program is distributed in the hope that it will be useful,
  27. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  28. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  29. # GNU General Public License for more details.
  30. #
  31. # You should have received a copy of the GNU General Public License
  32. # along with this program; if not, write to the Free Software
  33. # Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  34. #
  35. my @messages = ();
  36. my %PID_USER = ();
  37. my %PID_IP = ();
  38. my %PID_LENGTH = ();
  39. my %PID_SENT = ();
  40. my %PID_RECEIVED = ();
  41. my %PID_DATETIME = ();
  42. my %USER_TOTAL_CONNECT = ();
  43. my %USER_TOTAL_TIME = ();
  44. my %USER_TOTAL_SENT = ();
  45. my %USER_TOTAL_RECEIVED = ();
  46. my %vpnstats = ();
  47. @messages = <>;
  48. # for each line of input
  49. foreach my $x (@messages) {
  50. if ($x =~ /^(\w+\s+\d+\s\d+:\d+:\d+)\s # $1 = date+time
  51. \S+\spppd\[(\d+)\]:\s # $2 = PID
  52. MSCHAP-v2\speer\sauthentication\ssucceeded\sfor\s
  53. # I don't want the DOMAIN\\ prefix
  54. (.+\\)*(\w+)$ # $4 = username
  55. /x) {
  56. $PID_USER{$2} = $4;
  57. $PID_DATETIME{$2} = $1;
  58. $USER_TOTAL_CONNECT{$4}++;
  59. } elsif ($x =~ /^(\w+\s+\d+\s\d+:\d+:\d+)\s # $1 = date+time
  60. \S+\spppd\[(\d+)\]:\s # $2 = PID
  61. Connect\stime\s
  62. (\d*\.\d*) # $3 = minutes
  63. \sminutes\.$
  64. /x) {
  65. $PID_LENGTH{$2} = $3;
  66. $USER_TOTAL_TIME{$PID_USER{$2}} += $3;
  67. } elsif ($x =~ /^(\w+\s+\d+\s\d+:\d+:\d+)\s # $1 = date+time
  68. \S+\spppd\[(\d+)\]:\s # $2 = PID
  69. Sent\s(\d+)\sbytes,\s # $3 = bytes sent
  70. received\s(\d+)\s # $4 = bytes received
  71. /x) {
  72. $PID_SENT{$2} = $3;
  73. $PID_RECEIVED{$2} = $4;
  74. $USER_TOTAL_SENT{$PID_USER{$2}} += $3;
  75. $USER_TOTAL_RECEIVED{$PID_USER{$2}} += $4;
  76. } elsif ($x =~ /^(\w+\s+\d+\s\d+:\d+:\d+)\s # $1 = date+time
  77. \S+\spptpd\[(\d+)\]:\s # $2 = PID
  78. CTRL:\sClient\s
  79. (\d+\.\d+\.\d+\.\d+)\s # $3 = IP
  80. control\sconnection\sfinished$
  81. /x) {
  82. $PID_IP{($2+1)} = $3;
  83. if (!defined ($PID_USER{($2+1)})) {
  84. $PID_DATETIME{($2+1)} = $1;
  85. $PID_USER{($2+1)} = "FAILED";
  86. $USER_TOTAL_CONNECT{"FAILED"}++;
  87. }
  88. }
  89. }
  90. foreach my $user (sort keys %USER_TOTAL_CONNECT) {
  91. if (! defined $user) { next };
  92. if ($user ne "FAILED") {
  93. print $user, ": ", $USER_TOTAL_CONNECT{$user}, " connections, ";
  94. print $USER_TOTAL_TIME{$user}, " minutes (";
  95. print $USER_TOTAL_SENT{$user}, " sent, ";
  96. print $USER_TOTAL_RECEIVED{$user}, " received).\n";
  97. foreach my $pid (sort keys %PID_DATETIME) {
  98. if ($user eq $PID_USER{$pid}) {
  99. print " ";
  100. print $PID_DATETIME{$pid}, ": connected ";
  101. if ($PID_IP{$pid}) {
  102. print "from $PID_IP{$pid} ";
  103. print "for $PID_LENGTH{$pid} minutes.\n";
  104. } else {
  105. print "<still connected>\n";
  106. }
  107. }
  108. }
  109. }
  110. }
  111. if (defined $USER_TOTAL_CONNECT{"FAILED"}) {
  112. print "\n\n";
  113. print "FAILED CONNECTION ATTEMPTS: ";
  114. print $USER_TOTAL_CONNECT{"FAILED"}, "\n";
  115. foreach my $pid (sort keys %PID_DATETIME) {
  116. if ($PID_USER{$pid} eq "FAILED") {
  117. print " ";
  118. print $PID_DATETIME{$pid}, ": attempt from ";
  119. print $PID_IP{$pid}, "\n";
  120. }
  121. }
  122. }