Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with
or
.
Download ZIP
Newer
Older
100755 117 lines (95 sloc) 3.313 kB
89dbed7 @antirez Visitors moved to Git
authored
1 #!/usr/bin/perl
2 #
3 # Use this tool to convert IIS logs into NCSA format that
4 # Visitors will be able to handle.
5 #
6 # make an IIS log look strikingly like an apache log
7 # we make a vague attempt to interpret the Fields: header
8 # in an IIS logfile and use that to make IIS fields match up
9 # with apache fields.
10 #
11 # Copyright jwa@jammed.com 12 Dec 2000
12 #
13 # This software is released under the GPL license
14 # as specified in the home page: http://www.jammed.com/~jwa/hacks/
15
16 while ($arg = shift @ARGV) {
17 $tzoffset = shift @ARGV if ($arg eq "--faketz");
18 $vhost = shift @ARGV if ($arg eq "--vhost");
19 $debug = 1 if ($arg eq "--debug"); # show field interpretation
20 }
21
22 if ($tzoffset eq "") {
23 print STDERR "Will use -0000 as a fake tzoffset\n";
24 $tzoffset = "-0000";
25 }
26
27 # build month hash
28 @m = ('Jan','Feb','Mar','Apr','May','Jun','Jul','Aug','Sep','Oct','Nov','Dec');
29 while ($m = shift @m) {
30 $month{++$n} = $m;
31 }
32
33 # an IIS log adheres to what's defined by 'Fields;'
34 # attempt to parse this, tagging
35
36
37 LINE:
38 while ($line = <STDIN>) {
39 $line =~ s/\r|\n//g; # cooky DOS format
40 if ($line =~ /^#Fields: /) {
41 @line = split(" ", $line);
42 shift @line; # shifts of #Fields
43 # build a hash so we can look up a fieldname and
44 # have it return a position in the string
45 undef %fieldh;
46 $n = 0; # zero-based array for split
47 while ($l = shift @line) {
48 $fieldh{$l} = $n++;
49 print STDERR "$l is position $fieldh{$l}\n" if ($debug);
50 }
51
52 }
53 next LINE if ($line =~ /^#/);
54
55 #Fields: date time c-ip cs-username s-sitename s-computername s-ip cs-method cs-
56 #uri-stem cs-uri-query sc-status sc-win32-status sc-bytes cs-bytes time-taken
57 #s-port cs-version cs(User-Agent) cs(Cookie) cs(Referer)
58
59 # this is really slow.
60
61 $date = yankfield("date");
62 $time = yankfield("time");
63 $ip = yankfield("c-ip");
64 $username = yankfield("cs-username");
65 $method = yankfield("cs-method");
66 $stem = yankfield("cs-uri-stem");
67 $query = yankfield("cs-uri-query");
68 $status = yankfield("sc-status");
69 #$bytes = yankfield("cs-bytes");
70 # Which is it? sc-bytes or cs-bytes?
71 # cs-bytes only appears in some of the IIS logs I've seen.
72 # I'll assume that sc-bytes is "server->client bytes", which
73 # is what we want anyway.
74 $bytes = yankfield("sc-bytes"); # I'm gonna go with this.
75 $useragent = yankfield("cs(User-Agent)");
76 $referer = yankfield("cs(Referer)");
77
78 $useragent =~ s/\+/\ /g;
79
80 # our modified CLF sez:
81 # IP - - [DD/MMM/YYYY:HH:MM:SS TZOFFSET] "method stem[?query]" status bytes "referer" "user agent" "vhost"
82
83 # convert date
84 # 2000-07-19 00:00:01
85 ($y, $m, $d) = split("-", $date);
86 $m =~ s/^0//g;
87 $mname = $month{$m};
88
89 # build url
90 $url = $stem;
91 if ($query ne "-") {
92 $url .= "?$query";
93 }
94
95 # all done, print it out
96 print "$ip - - [${d}/${mname}/${y}:${time} ${tzoffset}] \"$method $url\" $status $bytes \"$referer\" \"$useragent\" \"${vhost}\"\n";
97 }
98
99
100 # return the proper field, or "-" if it's not defined.
101 # (unfortunately ($date) = (split(" ", $line))[$fieldh{date}];
102 # will return element 0 if $fieldh{date} is undefined . . .)
103
104 sub yankfield {
105 my ($field) = shift @_;
106
107 print STDERR "Looking at $field; position [$fieldh{$field}]\n" if ($debug);
108
109 if ($fieldh{$field} ne "") {
110 return (split(" ", $line))[$fieldh{$field}];
111 } else {
112 print STDERR "$field undefined\n" if ($debug);
113 return "-";
114 }
115 }
116
Something went wrong with that request. Please try again.