Update log analysis script to use Maxmind GeoIP data

[dns.git] / bin / sumlogs

diff --git a/bin/sumlogs b/bin/sumlogs
index 0db3ac6fb24f08471595f99e1f38238d3605af93..c46bcbaed4ede083dd458f36eb34258122d72a16 100755 (executable)
--- a/bin/sumlogs
+++ b/bin/sumlogs
@@ -3,41 +3,38 @@
 use strict;
 use warnings;
 
-use Net::Patricia;
+use Geo::IP;
 use YAML;
 
-my $pt = new Net::Patricia;
-
-open(COUNTRIES, "< /etc/powerdns/countries.conf") || die "Can't open /etc/powerdns/countries.conf";
-
-while (my $line = <COUNTRIES>)
-{
-    if ($line =~ /^(\d+\.\d+\.\d+\.\d+\/\d+)\s+:127\.\d+\.\d+\.\d+:([a-z]{2})/)
-    {
-        my $address = $1;
-        my $country = uc($2);
-
-        $pt->add_string($address, $country);
-    }
-}
-
-close(COUNTRIES);
-
+my $gi = Geo::IP->open("/usr/share/GeoIP/GeoIP.dat", GEOIP_MEMORY_CACHE);
 my $total_bytes = 0;
 my %country_bytes;
 
 while (my $record = <>)
 {
-    if ($record =~ /^\d+\.\d+\s+\d+\s+(\d+\.\d+\.\d+\.\d+)\s+TCP_[A-Z_]+\/\d+\s+(\d+) /)
+    if ($record =~ /^\d+\.\d+\s+\d+\s+(\d+\.\d+\.\d+\.\d+)\s+TCP_[A-Z_]+\/\d+\s+(\d+) (?:GET|HEAD|POST|OPTIONS|PROPFIND) /)
     {
         my $ip = $1;
         my $bytes = $2;
-        my $country = $pt->match_string($ip);
+        my $country = $gi->country_code_by_addr($ip);
 
-        $country_bytes{$country} += $bytes if defined($country);
+        if (defined($country) &&
+            $country ne "A1" && $country ne "A2" && 
+            $country ne "01" && $country ne "--")
+        {
+            $country_bytes{$country} += $bytes;
+        }
 
         $total_bytes += $bytes;
     }
+    elsif ($record =~ /^\d+\.\d+\s+\d+\s+(\d+\.\d+\.\d+\.\d+)\s+TCP_DENIED\/\d+\s+(\d+) /)
+    {
+       # do nothing
+    }
+    elsif ($record =~ /^\d+\.\d+\s+\d+\s+(\d+\.\d+\.\d+\.\d+)\s+UDP_[A-Z_]+\/\d+\s+(\d+) ICP_QUERY /)
+    {
+       # do nothing
+    }
     else
     {
         warn $record;
@@ -48,7 +45,7 @@ my %country_bandwidth;
 
 while (my($country,$bytes) = each %country_bytes)
 {
-    $country_bandwidth{$country} = $bytes * 250 * 1024 * 1024 / $total_bytes;
+    $country_bandwidth{$country} = $bytes * 300 * 1024 * 1024 / $total_bytes;
 }
 
 print Dump(\%country_bandwidth);