#!/usr/bin/perl
print "Content-type: text/html \n\n";

use IO::File;
use Socket;
use Fcntl;
use Time::localtime;
use Time::Local;
use strict;

my ($con, $res,$time_start,$time_stop,$date,$day,$month,$s_cur,$year,$TIME,$cur_TIME);
my ($line,$p,$i,$minutes,$hours,$seconds,$date_time,$record,$j,$r,$mark,$m,$fl,$key,$m);
my (@ary,@len,@nam,@LL,@LLL,@records,$form_data,$tm,$pin1);	# array, returned with request
my @mon=("Jan","Feb","Mar","Apr","May","Jun","Jul","Aug","Sep","Oct","Nov","Dec");
my @incl=(".gif",".GIF",".jpg",".ico",".css",".png","robots.txt",".crowl.","crowl.daidu","yandsearch?","semenov.itep","robot02.rambler","/bots","spider.html","bot.html","robot3.rambler","robot06.rambler","robot07.rambler","robot7.rambler","robot14.rambler","spider6.mail","spider01.yandex","spider25.picsearch","spider44.yandex","spider18.yandex","spider55.yandex",".googlebot.com","crawl.baidu.com","dotnetdotcom.org","search.msn.com","msnbot",".cuil.com","crawl.yahoo.net","bredband.telia.com",".us.archive.org",".naver.jp","av16570.comex.ru",".domolink.tula.net",".setooz.com","gigablast.com","78.41.98.38","78.41.98.166","94.103.89.246","robot07.rambler.ru","robot9.rambler.ru","spider27.picsearch","spider30.picsearch","spider23.picsearch","turbospider.yandex","robot7.rambler.ru","spider09.yandex");
my (@ar,@MMM,@MM,@NNN,@file,@LL);
my %rec=();
my $day_night=86400;			# seconds in a day
my $start_time=time-$day_night;
my $i=0;
my $k=0;
my $n_req=0;
my $flag=0;				# Is the data in memory? (not the first request)

#########################################
# Yu. Semenov				#
# Script reads file:			#
# <access_log>, remove dependent &	#
# search requests, putting down		#
# records with time > $start_time 	#
# and write the result			#
# into the file <access_log.filt>	#
#########################################

$p="/var/log/httpd/access_log";		# input file  <access_log>
my $path_d="/var/log/httpd/";
#opendir(DIR,$path_d);

# calculate access_log file, taking the latest one

my $n_max=0;
#@file=grep {/access_log/} readdir(DIR);
#for($i=0;$i<4;$i++)	{$LL[$i]=substr($file[$i],11);
#			if($LL[$i]>$n_max)	{$n_max=$LL[$i];
#			$m=$i;			}
#			}
#my $file_name="access_log"."-".$LL[$m];
#print "F_name=",$file_name," LL=",$LL[$m],"\n";
#closedir(DIR);
#$p=$p."-".$LL[$m];
#print "P=",$p,"\n";

#@list=grep {/access/} readdir(DIR);

open(h_point,$p) or die "Can't start tst1: $!\n";
$pin1="/home/httpd/htdocs/saturn/attacks/ids/access_log.filt";	# Filtered Log-file
#print "Start\n";
sysopen(Fpi, $pin1, O_RDWR|O_TRUNC|O_CREAT) or die$!;	# Open/create file <access_log.filt>
#print "start2\n";
#########################################
while (!eof(h_point)) 	{		# Cycle for <access_log>-file	#########
$line=readline(h_point);		# read line of <access_log>		#
@ar=split(//,$line);			# $#ar = symbol number in line		#

if($#ar>52)	{			# line length control	######		#
#print "Line=",$line,"\n";		#
@MM=split/\s+/,$line;			#
$date_time=substr($MM[3],1,20);		# leading [-symbol removing 		#
@MMM=split(/\:/,$date_time);		#

if($#MMM==3){				# date terms number control #####	#
$date=$MMM[0];				#	#
@NNN=split(/\//,$date);			#	#
if(!(defined$NNN[0]))	{$NNN[0]=1;}	#	#				#
    $day=$NNN[0];			#	#
if(!(defined$NNN[1]))	{$NNN[1]=1;}	#	#
$month=$NNN[1];				#	#				#

for($i=0;$i<12;$i++){			#########				#
if($month eq $mon[$i]){$month=$i;}		#
		    }			#########
if(!(defined$NNN[2]))	{$NNN[2]=2;}	#	#
$year=$NNN[2];				#	#
$year=$year-1900;			#	#				#
if(!(defined$MMM[1]))	{$MMM[1]=1;}	#	#
$hours=$MMM[1];				#	#
if(!(defined$MMM[2]))	{$MMM[2]=1;}	#	#
$minutes=$MMM[2];			#	#
if(!(defined$MMM[3]))	{$MMM[3]=1;}	#  	#				#
$seconds=$MMM[3];			#	#
$cur_TIME=timelocal($seconds,$minutes,$hours,$day,$month,$year);#
#print " year=",$year," mon=",$month," day=",$day," hour=",$hours," min=",$minutes," sec=",$seconds,"\n";
	    }				#######	#
		}		

if ($line=~m/\.gif|\.GIF|\.jpg|\.ico|\.css|\.png|robots\.txt|\.crowl\.|crowl\.daidu|yandsearch\?|semenov\.itep|robot02\.rambler|\/bots|spider\.html|bot\.html|robot3\.rambler|robot06\.rambler|robot07\.rambler|robot7\.rambler|robot14\.rambler|spider6\.mail|spider01\.yandex|spider25\.picsearch|spider44\.yandex|spider18\.yandex|spider55\.yandex|\.googlebot\.com|crawl\.baidu\.com|dotnetdotcom\.org|search\.msn\.com|msnbot|\.cuil\.com|crawl\.yahoo\.net|bredband\.telia\.com|\.us\.archive\.org|\.naver\.jp|av16570\.comex\.ru|\.domolink\.tula\.net|\.setooz\.com|gigablast\.com|78\.41\.98\.38|78\.41\.98\.166|94\.103\.89\.246|robot07\.rambler\.ru|robot9\.rambler\.ru|spider27\.picsearch|spider30\.picsearch|spider23\.picsearch|turbospider\.yandex|robot7\.rambler\.ru|spider09\.yandex|Mail\.RU_Bot|SemrushBot|YandexBot/){$fl=1}	#	   # filter dependent & search requests
else{$fl=0;}	#########################	
if($fl==0)	{	# There is no useless includings   ######		#
								#
$records[$n_req]=$line;	# put down the record			#		#
if($cur_TIME>$start_time)	{		#########	#
$rec{$records[$n_req]}=$cur_TIME;	# hash rec	#	#		#
				}		#########	#		#
$n_req++;							#		#
		}					 ########		#

			}		# end of WHILE			#########

close(h_point);

foreach $key (sort {$rec{$a}<=>$rec{$b}} keys %rec)
{
#print "rec=",$records[$counts],"\n";
print Fpi $key;
#print "R=",$rec{$records[$key]},"\n";
#print "Re=",$key,"\n";
}
close(Fpi);
#print "Records=",$n_req,"\n";

#print "</head></html>";
do "/home/crontab_files/pars_access2.pl";	# start <pars_access2.pl

#exit(0);

