分析unix系统日期析取ftp登陆和断开信息
關于JAVA滴
使用com.enterprisedt.net.ftp庫連接客戶在HPUnix上的FTP服務器,不定時的出現連接不上去的情況,但是使用FTP客戶端卻可以直接連接。
客戶不讓telnet主機,只好要了syslog文件自己分析。
看了一下,相關FTPD的有三個記錄
我不管連接的記錄(ftp里面的conn操作),只處理login和logout操作。
如下
Dec 23 05:01:44 服務器主機名 ftpd[18609]: FTP LOGIN FROM 客戶機IP地址 [客戶機IP地址], fileplat
Dec 23 05:03:11 服務器主機名 ftpd[18609]: FTP session closed
Jan 28 09:28:48 服務器主機名 ftpd[18609]: FTP LOGIN FROM unicom-1 [客戶機IP地址], fileplat
Jan 28 09:28:50 服務器主機名 ftpd[18609]: FTP session closed
Feb 17 21:37:35 服務器主機名 ftpd[18609]: FTP LOGIN FROM unicom-1 [客戶機IP地址], fileplat
Feb 17 21:58:01 服務器主機名 ftpd[18609]: exiting on signal 14
Feb 19 02:38:34 服務器主機名 ftpd[18609]: FTP LOGIN FROM 客戶機IP地址 [客戶機IP地址], fileplat
Feb 19 02:38:35 服務器主機名 ftpd[18609]: FTP session closed
ftpd后面的方括號里面是客戶登陸之后的進程號(線程號???),確定一個ftp Session。正常退出使用Ftp Session closed。否則是exiting on signal.
下面是簡單的程序
程序將一個ftp登陸的數據操作記錄到數據庫,這樣可以分析出客戶連接主機的頻率和每次時長
因為只用一次,代碼很土
??java.io.BufferedReader r = new BufferedReader(new java.io.FileReader(
??????????? "E:\\syslog.log"));
??????? FileWriter f = new FileWriter("e:\\syslog.sql");
??????? String str = null;
??????? int nRow = 0;
??????? java.util.Hashtable hashIpAddress = new java.util.Hashtable();
??????? java.util.Hashtable hashLoginTime = new java.util.Hashtable();
??????? while((str = r.readLine()) != null)
??????? {
??????????? if(false == (
??????????????? //(str.indexOf("inetd[")>=0 && str.indexOf("ftp/tcp:")>=0)||
??????????????? (str.indexOf("ftpd[") >= 0 && str.indexOf("FTP") >= 0)
?????????????? ))
??????????? {
??????????????? continue;
??????????? }
??????????? nRow++;
//??????????? if(nRow>100)
//??????????? {
//??????????????? break;
//??????????? }
??????????? //System.out.println(str);
??????????? if(str.length() < 16)
??????????? {
??????????????? continue;
??????????? }
??????????? String strDate = str.substring(0,16);
??????????? String[] alldates = strDate.split(" ");
//??????????? for(int i =0;i<alldates.length;i++)
//??????????? {
//??????????????? System.out.println("Part "+i +"? "+alldates[i]);
//??????????? }
??????????? if(alldates[0].equals("Dec"))
??????????? {
??????????????? strDate = "2005-12-";
??????????? }
??????????? else if(alldates[0].equals("Jan"))
??????????? {
??????????????? strDate = "2006-01-";
??????????? }
??????????? else if(alldates[0].equals("Feb"))
??????????? {
??????????????? strDate = "2006-02-";
??????????? }
??????????? else
??????????? {
??????????? ?continue;
??????????? }
??????????? if(alldates[1].trim().length()<1)
??????????? {
??????????????? strDate+=alldates[2]+" "+alldates[3];
??????????? }
??????????? else
??????????? {
??????????????? strDate+=alldates[1]+" "+alldates[2];
??????????? }
??????????? str = str.substring(16);
??????????? String[] allparts = str.split(" ");
//??????????? for(int i =0;i<allparts.length;i++)
//??????????? {
//??????????????? System.out.println("Part "+i +"? "+allparts[i]);
//??????????? }
??????????? String strFtpID = allparts[1];
??????????? strFtpID = strFtpID.substring(strFtpID.indexOf("[") + 1,
????????????????????????????????????????? strFtpID.indexOf("]"));
??????????? boolean bCloseSection = str.indexOf("FTP LOGIN FROM")<0;
??????????? String strSql = null;
??????????? if(bCloseSection)
??????????? {
??????????????? if(hashIpAddress.containsKey(strFtpID))
??????????????? {
??????????????????? //System.out.println(strFtpID+"斷開連接 "+allparts[2]);
??????????????????? ss(sqlca,f, nRow, hashIpAddress, hashLoginTime, strDate, strFtpID, strSql);
??????????????????? hashIpAddress.remove(strFtpID);
??????????????????? hashLoginTime.remove(strFtpID);
??????????????? }
??????????? }
??????????? else
??????????? {
??????????????? //System.out.println(strFtpID+"客戶IP"+allparts[5]);
??????????????? if(str.indexOf("[您的IP地址]")>=0 && str.indexOf("FTP LOGIN FROM")>=0)
??????????????? {
??????????????????? hashIpAddress.put(strFtpID,"[您的IP地址]");
??????????????????? hashLoginTime.put(strFtpID,strDate);
??????????????? }
??????????? }
??????? }
??????? f.flush();
??????? f.close();
??????? r.close();
??????? System.exit(1);
???????
???????
???????
???????? private static void ss(FileWriter f,int nRow,Hashtable hash,Hashtable hash2,
?????????????????????????? String strDate,String strFtpID,String strSql)
??????? throws Exception
??? {
??????? strSql =
??????????? "insert into ftplog(logid,ip,logouttime,logintime) values(" +
??????????? "'" + strFtpID + "'," +
??????????? "'" + hash.get(strFtpID) + "'," +
??????????? "to_date('" + strDate + "','yyyy-mm-dd HH24:mi:ss')," +
??????????? "to_date('" + hash2.get(strFtpID) +
??????????? "','yyyy-mm-dd HH24:mi:ss')" +
??????????? ")";
??????? System.out.println(nRow + "???? " + strSql);
??????? f.write(strSql + ";\r\n");
??? }
轉載于:https://www.cnblogs.com/JeasonZhao/archive/2006/02/21/334946.html
總結
以上是生活随笔為你收集整理的分析unix系统日期析取ftp登陆和断开信息的全部內容,希望文章能夠幫你解決所遇到的問題。
- 上一篇: 一个笑话,关于哲人和普通人的
- 下一篇: Qomolangma实现篇(四):基本特