Counting device reboots

[Mista_Blista]

Hello,

I know this must be amazingly easy but I am a perl amateur. I want to use
perl to analyze the log file info shown below, and count the number of times
each IP address appears. I also want it to show me the range of dates and
times of the first and last time the IP address appears in the log file.


Oct 6 17:15:38 172.16.21.101
Oct 7 14:49:17 172.16.21.101
Oct 7 17:35:22 172.16.21.101
Oct 3 15:26:57 172.16.21.102
Oct 5 11:28:24 172.16.21.102
Oct 5 14:09:52 172.16.21.102
Oct 5 23:34:39 172.16.21.102
Oct 6 00:26:09 172.16.21.102
Oct 7 04:11:32 172.16.21.102
Oct 3 00:03:58 172.16.21.103
Oct 3 22:45:57 172.16.21.103
Oct 4 12:55:10 172.16.21.103
Oct 4 13:34:11 172.16.21.103
Oct 5 02:20:49 172.16.21.103
Oct 6 03:46:05 172.16.21.103
Oct 6 13:22:40 172.16.21.103
Oct 6 13:43:14 172.16.21.103
Oct 6 15:24:55 172.16.21.103
Oct 6 16:17:43 172.16.21.103
Oct 8 00:35:24 172.16.21.103
Oct 2 16:43:13 172.16.21.104
Oct 2 21:29:22 172.16.21.104
Oct 3 15:17:24 172.16.21.104
Oct 4 00:12:18 172.16.21.104
Oct 6 00:42:07 172.16.21.104
Oct 6 14:10:25 172.16.21.104
Oct 6 16:25:00 172.16.21.104
Oct 6 16:32:35 172.16.21.104
Oct 6 17:51:06 172.16.21.104
Oct 6 18:09:04 172.16.21.104

The output would be similar to this below

Date Range Device # of Reboots
Oct.2 - Oct. 6 172.16.21.104 10

 

[Anno Siegel]

Hello,

I know this must be amazingly easy but I am a perl amateur. I want to use
perl to analyze the log file info shown below, and count the number of times
each IP address appears. I also want it to show me the range of dates and
times of the first and last time the IP address appears in the log file.

Oct 6 17:15:38 172.16.21.101
Oct 7 14:49:17 172.16.21.101
Oct 5 11:28:24 172.16.21.102

You will first have to collect all the dates that pertain to one
address in an array. This code does that:

my %coll;
while ( <DATA> ) {
chomp;
my ( $date, $ip) = split /(?<=:\d\d) /;
push @{ $coll{ $ip}}, $date;
}

The number of reboots is the number of elements of each array. Now find
a module on CPAN that can parse your date format into something easily
comparable (epoch seconds), and extract the maximum and minimum from each
list.

Anno

 

[John W. Krahn]

I know this must be amazingly easy but I am a perl amateur. I want to use
perl to analyze the log file info shown below, and count the number of times
each IP address appears. I also want it to show me the range of dates and
times of the first and last time the IP address appears in the log file.

Oct 6 17:15:38 172.16.21.101

[snip]

Oct 6 18:09:04 172.16.21.104

The output would be similar to this below

Date Range Device # of Reboots
Oct.2 - Oct. 6 172.16.21.104 10

Here is one way to do it:

#!/usr/bin/perl
use warnings;
use strict;

use Socket;

my %mons = qw/ Jan 0 Feb 1 Mar 2 Apr 3 May 4 Jun 5 Jul 6 Aug 7 Sep 8 Oct 9 Nov 10 Dec 11 /;
my @mons = qw/ Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec /;
my $mon = qr/@{[ join '|', @mons ]}/;

my %data;
while ( <> ) {
next unless /^($mon) \s+ (\d+) \s+ \d+:\d+:\d+ \s+ (\d+\.\d+\.\d+\.\d+)/x;

my $date = sprintf '%02d%02d', $mons{ $1 }, $2;
my $ip = inet_aton $3;

$data{ $ip }{ count }++;

$data{ $ip }{ max } = $date if not exists $data{ $ip }{ max } or $data{ $ip }{ max } lt $date;
$data{ $ip }{ min } = $date if not exists $data{ $ip }{ min } or $data{ $ip }{ min } gt $date;
}

printf "%-20s %-20s %s\n", 'Date Range', 'Device', '# of Reboots';

for my $ip ( sort keys %data ) {

my $range = sprintf '%s %d - %s %d',
$mons[ substr $data{ $ip }{ min }, 0, 2 ],
substr( $data{ $ip }{ min }, 2 ),
$mons[ substr $data{ $ip }{ max }, 0, 2 ],
substr( $data{ $ip }{ max }, 2 );

printf "%-20s %-20s %s\n", $range, inet_ntoa( $ip ), $data{ $ip }{ count };
}

__END__



John