1 #!/bin/bash
2 ###########################################
3 #
4 # version: 3.0.0
5 # creator: zenghui
6 # datetime: 05/06/2015
7 #
8 ###########################################
9 #判断命令行参数
10 if [ "$1" = "-f" ] && [ "$2" != "" ]
11 then
12 access_log="$2"
13
14 #定义输入时间
15 function feng() {
16 read -p "请输入开始时间(10:30:00)秒数不输入默认为00: " a
17 read -p "请输入结束时间(10:35:00)秒数不输入默认为00: " b
18 if [[ "$a" =~ ^[0-9]{2}:[0-9]{2}:[0-9]{2}$ ]]
19 then
20 time_qing=`date +'['%d/%b/%Y:`$a
21 else
22 time_qing=`date +'['%d/%b/%Y:`$a":00"
23 fi
24
25 if [[ "$b" =~ ^[0-9]{2}:[0-9]{2}:[0-9]{2}$ ]]
26 then
27 time_hou=`date +'['%d/%b/%Y:`$b
28 else
29 time_hou=`date +'['%d/%b/%Y:`$b":00"
30 fi
31 awk_value=`awk -v a=$time_qing -v b=$time_hou 'BEGIN{if (a>b) print "yes"}'`
32 }
33
34 #定义主菜单
35 function menu() {
36 clear
37 echo -e "****************33[34;7m 日志统计33[0m*********************"
38 echo "* 1、全站统计 *"
39 echo "* 2、以时间统计 *"
40 echo "* 3、exit *"
41 echo "*********************************************"
42 }
43
44
45 #定义全站统计共享函数
46 function cmdquanz() {
47 echo "$total"
48 read -p "请输入编号显示ip的url记录: " totip
49 tot=`echo "$total" | awk -v totip="$totip" '{if ($1 == totip) print $3}'`
50 tempfile=`mktemp`
51 temp1=`mktemp`
52 temp2=`mktemp`
53 echo $tempfile' '$temp1' '$temp2
54 cat "$access_log" | awk -v tot=$tot '{if ($1 == tot) print $0}'> $tempfile
55 awk '{print "33[31m "$7" 33[0m""33[32m "$10/1024/1024"MB 33[0m"}' $tempfile > $temp1
56 awk -F'"' '{print "33[34m "$6" 33[0m"}' $tempfile > $temp2
57 paste $temp1 $temp2 | sort | uniq -c | sort -nr |more
58 #echo $tot
59 #cat "$access_log" | awk -v tot=$tot '{if ($1 == tot) print $7}' | sort | uniq -c | sort -nr |more
60 read -p "q退出上一级，Enter 继续" i
61 if [ "$i" = "q" ];then
62 quanz
63 else
64 clear
65 cmdquanz
66 fi
67 }
68
69 #iptables函数
70 function Iptables() {
71 echo -e "*******************33[34;7m 功能选择33[0m******************"
72 echo "* 1、显示ip的url、agent *"
73 echo "* 2、将ip加入iptables *"
74 echo "* 3、将ip加入nginx黑名单 *"
75 echo "* 4、exit *"
76 echo "*********************************************"
77 read -p "请输入您要选择的编号： " Ipt
78 }
79
80 function Ima() {
81 echo -e "*****************33[34;7m 功能选择33[0m****************************"
82 echo "* 1、单个ip加入nginx黑名单 *"
83 echo "* 2、全加入nginx黑名单 *"
84 echo "* 3、回上一级 *"
85 echo "* 4、exit *"
86 echo "******************************************************"
87 read -p "请输入您要选择的编号： " imge
88 }
89
90 #定义访问都是静态文件函数
91 function Images() {
92 read -p "输入你要查询的关键字(jpg,js,html)：" gjz
93 feng
94 jpg_ip=`cat /var/log/nginx/access_www.log |awk -v a=$time_qing -v b=$time_hou '{if ($4>a && $4<b) print $0}' | awk -v gjz=$gjz '{m[$1]=m[$1]+$10}{ipp[$1]=ipp[$1]+1}{if ($7 ~ gjz){a=1;ip[$1]=ip[$1]+a}}END{for(i in ip) if (ipp[i]==ip[i] && m[i]>1000000) print i,m[i]/1024/1024"MB"}' | sort -k 2 -nr | head -20 | cat -n`
95 echo "$jpg_ip"
96 Ima
97 case $imge in
98 1)
99 read -p "再输入之前的ip编号(加入黑名单)：" imge_ip
100 tot=`echo "$jpg_ip" | awk -v im="$imge_ip" '{if ($1 == im) print $2}'`
101 nginx_black
102 read -p "Enter 继续"
103 shij;;
104 2)
105 read -p "确定请按Y/y：" ye
106 if [ "$ye" = "Y" ] || [ "$ye" = "y" ];then
107 shibai=`cat /usr/local/lnmp/nginx/conf/black.list`
108 chg=`echo "$jpg_ip" | awk '{print "deny "$2";"}' && cat /usr/local/lnmp/nginx/conf/black.list | sort | uniq | grep -v "58.247.43.226"`
109 echo "$chg" > /usr/local/lnmp/nginx/conf/black.list
110 if [ "`/usr/local/lnmp/nginx/sbin/nginx -t > /dev/null 2>&1 && echo $?`" == "0" ];then
111 /usr/local/lnmp/nginx/sbin/nginx -s reload > /dev/null 2>&1
112 echo "nginx 配置文件重新加载成功"
113 else
114 echo "nginx 配置文件重新加载失败"
115 echo "$shibai" > /usr/local/lnmp/nginx/conf/black.list
116 fi
117 fi
118 read -p "Enter 继续"
119 shij;;
120 3)
121 shij;;
122 *)
123 exit;;
124 esac
125 }
126
127 ＃定义nginx黑名单
128 function nginx_black() {
129 nginx_black=/usr/local/lnmp/nginx/conf/black.list
130 if [ "$tot" != "" ];then
131 cat /usr/local/lnmp/nginx/conf/black.list | grep "$tot" || echo "deny $tot;">>$nginx_black
132 echo "$tot 已加入nginx黑名单"
133 if [ "`/usr/local/lnmp/nginx/sbin/nginx -t > /dev/null 2>&1 && echo $?`" == "0" ];then
134 /usr/local/lnmp/nginx/sbin/nginx -s reload > /dev/null 2>&1
135 echo "nginx 配置文件重新加载成功"
136 else
137 echo "nginx 配置文件重新加载失败"
138 fi
139 fi
140 }
141
142 #定义以时间统计共享函数
143 function cmdshij() {
144 echo "$total"
145 read -p "请输入编号: " totip
146 tot=`echo "$total" | awk -v totip="$totip" '{if ($1 == totip) print $3}'` #获取ip
147 Iptables
148
149 #对ip进行整理输出
150 case $Ipt in
151 1)
152 echo $tot' ptr'`dig -x $tot +short`
153 tempfile=`mktemp`
154 temp1=`mktemp`
155 temp2=`mktemp`
156 echo $tempfile' '$temp1' '$temp2
157 awk -v a=$time_qing -v b=$time_hou '{if ($4>a && $4<b) print $0}' "$access_log" | awk -v tot=$tot '{if ($1 == tot) print $0}'> $tempfile
158 awk '{print "33[31m "$7" 33[0m""33[32m "$10/1024/1024"MB 33[0m"}' $tempfile > $temp1
159 awk -F'"' '{print "33[34m "$6" 33[0m"}' $tempfile > $temp2
160 paste $temp1 $temp2 | sort | uniq -c | sort -nr |more
161 read -p "q退出上一级，Enter继续" i
162 if [ "$i" = "q" ];then
163 shij
164 else
165 clear
166 cmdshij
167 fi;;
168 2)
169 if [ "$tot" != "" ];then
170 iptables -L -n | grep "$tot" >/dev/null || iptables -I INPUT -s $tot -j DROP
171 echo "$tot 已加入iptables"
172 fi
173 read -p "q退出上一级，Enter继续" i
174 if [ "$i" = "q" ];then
175 shij
176 else
177 clear
178 cmdshij
179 fi;;
180 3)
181 nginx_black
182 read -p "q退出上一级，Enter继续" i
183 if [ "$i" = "q" ];then
184 shij
185 else
186 clear
187 cmdshij
188 fi;;
189 *)
190 exit;;
191 esac
192
193 }
194
195 #定义全站统计函数
196 function quanz() {
197 clear
198 echo -e "****************33[34;7m全站统计33[0m*********************"
199 echo "* 1、以流量排序 *"
200 echo "* 2、以ip个数排序 *"
201 echo "* 3、回上一级 *"
202 echo "* 5、退出 *"
203 echo "*********************************************"
204 read -p "请输入编号: " qz
205 case $qz in
206 1)
207 total=`awk '{a[$1]=a[$1]+$10;++b[$1]}END{for(i in a)print a[i]/1024/1024"MB",i,b[i]}' "$access_log" | sort -nr | head -20| cat -n`
208 cmdquanz
209 quanz;;
210 2)
211 total=`awk '{a[$1]=a[$1]+$10;++b[$1]}END{for(i in a)print a[i]/1024/1024"MB",i,b[i]}' "$access_log" | sort -k 3 -nr | head -20| cat -n`
212 cmdquanz
213 quanz;;
214 3)
215 menu;;
216 *)
217 exit;;
218 esac
219 }
220
221 #定义以时间统计函数
222 function shij() {
223 clear
224 echo -e "****************33[34;7m以时间统计33[0m*******************"
225 echo "* 1、以流量排序 *"
226 echo "* 2、以ip个数排序 *"
227 echo "* 3、时间段ip总数 *"
228 echo "* 4、时间段全访问jpg or html *"
229 echo "* 5、回上一级 *"
230 echo "* 6、退出 *"
231 echo "*********************************************"
232 read -p "请输入编号: " sj
233 case $sj in
234 1)
235 feng
236 if [ ${awk_value:-no} = "yes" ] || [ "$a" = "" ] || [ "$b" = "" ]
237 then
238 clear
239 echo "输入有误,请重新输入"
240 shij
241 else
242 total=`awk -v a=$time_qing -v b=$time_hou '{if ($4>a && $4<b) print $0}' "$access_log"| awk '{a[$1]=a[$1]+$10;++b[$1]}END{for(i in a)print a[i]/1024/1024"MB",i,b[i]}' | sort -nr | head -20 | grep -v "e-" | cat -n`
243 cmdshij
244 shij
245 fi;;
246 2)
247 feng
248 if [ ${awk_value:-no} = "yes" ] || [ "$a" = "" ] || [ "$b" = "" ]
249 then
250 clear
251 echo "输入有误,请重新输入"
252 shij
253 else
254 total=`awk -v a=$time_qing -v b=$time_hou '{if ($4>a && $4<b) print $0}' "$access_log"| awk '{a[$1]=a[$1]+$10;++b[$1]}END{for(i in a)print a[i]/1024/1024"MB",i,b[i]}' | sort -k 3 -nr | head -20| cat -n`
255 cmdshij
256 shij
257 fi;;
258 3)
259 feng
260 echo "ip总数: ""`awk -v a=$time_qing -v b=$time_hou '{if ($4>a && $4<b) print $0}' "$access_log"| awk '{print $1}' | sort | uniq -c | wc -l`"
261 awk -v a=$time_qing -v b=$time_hou '{if ($4>a && $4<b) print $0}' "$access_log"| awk '{print $1}' | sort | uniq -c | sort -nr |more
262 read -p "Enter 继续"
263 shij;;
264 4)
265 Images;;
266 5)
267 menu;;
268 *)
269 exit;;
270 esac
271 }
272
273 #循环显示
274 while true
275 do
276 menu
277 read -p "请输入编号： " bh
278 case $bh in
279 1)
280 quanz;;
281 2)
282 shij;;
283 *)
284 exit;;
285 esac
286 done
287 #初始化变量aa
288 elif [ "${aa:--h}" = "-h" ]
289 then
290 echo "运行: ./datalog_ip_sort.sh -f 日志文件"
291 fi
