113 lines
6.0 KiB
PowerShell
113 lines
6.0 KiB
PowerShell
$str = get-item '\\rejk-p-web005\d-drive\Logfiles\W3SVC1\u_ex161229.log','\\rejk-p-web006\d-drive\Logfiles\W3SVC1\u_ex161229.log','\\rejk-p-web007\d-drive\Logfiles\W3SVC1\u_ex161229.log','\\rejk-p-web008\d-drive\Logfiles\W3SVC1\u_ex161229.log' | Select-String -Pattern 'rejsekort/2015'
|
|
$csv = $str | select -expand line | ConvertFrom-Csv -Delimiter ' ' -Header ('date time s-sitename s-computername s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs-version cs(User-Agent) cs(Cookie) cs(Referer) cs-host sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken' -split ' ')
|
|
$group = $csv | group 'cs-uri-stem'
|
|
|
|
|
|
|
|
$csv = Import-Csv -Delimiter ' ' -Header ('date time s-sitename s-computername s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs-version cs(User-Agent) cs(Cookie) cs(Referer) cs-host sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken' -split ' ') -Path '\\rejk-p-web005\d-drive\Logfiles\W3SVC1\u_ex161229.log','\\rejk-p-web006\d-drive\Logfiles\W3SVC1\u_ex161229.log','\\rejk-p-web007\d-drive\Logfiles\W3SVC1\u_ex161229.log','\\rejk-p-web008\d-drive\Logfiles\W3SVC1\u_ex161229.log'
|
|
|
|
|
|
$content = Get-Content '\\rejk-p-web005\d-drive\Logfiles\W3SVC1\u_ex161229.log','\\rejk-p-web006\d-drive\Logfiles\W3SVC1\u_ex161229.log','\\rejk-p-web007\d-drive\Logfiles\W3SVC1\u_ex161229.log','\\rejk-p-web008\d-drive\Logfiles\W3SVC1\u_ex161229.log'
|
|
|
|
|
|
|
|
|
|
$csv = foreach($file in '\\rejk-p-web005\d-drive\Logfiles\W3SVC1\u_ex161229.log','\\rejk-p-web006\d-drive\Logfiles\W3SVC1\u_ex161229.log','\\rejk-p-web007\d-drive\Logfiles\W3SVC1\u_ex161229.log','\\rejk-p-web008\d-drive\Logfiles\W3SVC1\u_ex161229.log') {
|
|
|
|
$stream = New-Object System.IO.StreamReader -ArgumentList $file
|
|
|
|
while($line = $stream.ReadLine()) {
|
|
|
|
if($line.StartsWith('#')) { continue }
|
|
|
|
if($line -match '/cws/Error/DefaultError') {
|
|
$line | ConvertFrom-Csv -Delimiter ' ' -Header ('date time s-sitename s-computername s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs-version cs(User-Agent) cs(Cookie) cs(Referer) cs-host sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken' -split ' ')
|
|
}
|
|
|
|
}
|
|
|
|
$stream.Close()
|
|
}
|
|
|
|
|
|
$group[7].group | sort time | ft time, 'cs-uri-query' -AutoSize
|
|
|
|
$group.group | foreach { $datetime = "$($_.date) $($_.time)"; $datetime = Get-Date $datetime; $datetime = $datetime.AddHours(1); $_ | Add-Member -MemberType NoteProperty -Name DateTime -Value $datetime.ToString('yyyy-MM-dd HH:mm:ss') }
|
|
|
|
$group.group | sort datetime | where 'cs-uri-query' -notmatch '\.png' | ft 's-computername', 'time-taken', datetime, 'cs-method', 'cs-uri-query', @{ N='Agent'; E={
|
|
$os = $agent = $_.'cs(User-Agent)'
|
|
|
|
if($os -match 'Windows') { $os = 'Windows' }
|
|
if($os -match 'iPhone|Darwin') { $os = 'iPhone' }
|
|
if($os -match 'iPad') { $os = 'iPad' }
|
|
if($os -match 'Dalvik|Android') { $os = 'Android' }
|
|
if($os -match 'Mac\+OS\+X') { $os = 'Mac' }
|
|
if($os -match 'Ubuntu') { $os = 'Ubuntu' }
|
|
if($os -match 'Linux') { $os = 'Linux' }
|
|
|
|
|
|
if($agent -match 'chrome') { $agent = 'Chrome' }
|
|
if($agent -match 'Firefox') { $agent = 'Firefox' }
|
|
if($agent -match 'Safari') { $agent = 'Safari' }
|
|
if($agent -match 'Mit%20Rejsekort') { $agent = '"MitRejsekort" App' }
|
|
if($agent -match 'Rejs%20Nemt') { $agent = '"Rejs Nemt" App' }
|
|
if($agent -match 'Rejsekort/2015') { $agent = '"Rejsekort(??)" App' }
|
|
if($agent -match 'Mozilla\/5.0\+\(Windows\+NT\+[0-9]+.[0-9]+;\+WOW64;\+Trident\/7\.0;\+rv:11.0\)\+like\+Gecko') { $agent = 'Internet Explorer' }
|
|
|
|
"$os / $agent"
|
|
}} -AutoSize
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
$csvApp = foreach($file in '\\rejk-p-app004\d-drive\Logfiles\W3SVC3\u_ex161229.log','\\rejk-p-app003\d-drive\Logfiles\W3SVC3\u_ex161229.log','\\rejk-p-app002\d-drive\Logfiles\W3SVC3\u_ex161229.log','\\rejk-p-app001\d-drive\Logfiles\W3SVC3\u_ex161229.log') {
|
|
Write-Progress -Activity 'Csv APP' -Status "File: $($file)" -id 1
|
|
$stream = New-Object System.IO.StreamReader -ArgumentList $file
|
|
|
|
while($line = $stream.ReadLine()) {
|
|
Write-Progress -Activity 'Readline' -Status "Position $($stream.BaseStream.Position) / $($stream.BaseStream.Length)" -PercentComplete (100 / $stream.BaseStream.Length * $stream.BaseStream.Position) -parentid 1 -id 2
|
|
|
|
if($line.StartsWith('#')) { continue }
|
|
|
|
$c = $line | ConvertFrom-Csv -Delimiter ' ' -Header ('date time s-sitename s-computername s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs-version cs(User-Agent) cs(Cookie) cs(Referer) cs-host sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken' -split ' ')
|
|
<#if([int]$c.'time-taken' -gt 5000) {
|
|
$c
|
|
}#>
|
|
|
|
$c
|
|
}
|
|
|
|
$stream.Close()
|
|
|
|
}
|
|
|
|
$csvApp | foreach { $datetime = "$($_.date) $($_.time)"; $datetime = Get-Date $datetime; $datetime = $datetime.AddHours(1); $_ | Add-Member -MemberType NoteProperty -Name DateTime -Value $datetime.ToString('yyyy-MM-dd HH:mm:ss') }
|
|
|
|
$csvApp | sort datetime | ft 's-computername', 'time-taken', datetime, 'cs-method', 'cs-uri-query', @{ N='Agent'; E={
|
|
$os = $agent = $_.'cs(User-Agent)'
|
|
|
|
if($os -match 'Windows') { $os = 'Windows' }
|
|
if($os -match 'iPhone|Darwin') { $os = 'iPhone' }
|
|
if($os -match 'iPad') { $os = 'iPad' }
|
|
if($os -match 'Dalvik|Android') { $os = 'Android' }
|
|
if($os -match 'Mac\+OS\+X') { $os = 'Mac' }
|
|
if($os -match 'Ubuntu') { $os = 'Ubuntu' }
|
|
if($os -match 'Linux') { $os = 'Linux' }
|
|
|
|
|
|
if($agent -match 'chrome') { $agent = 'Chrome' }
|
|
if($agent -match 'Firefox') { $agent = 'Firefox' }
|
|
if($agent -match 'Safari') { $agent = 'Safari' }
|
|
if($agent -match 'Mit%20Rejsekort') { $agent = '"MitRejsekort" App' }
|
|
if($agent -match 'Rejs%20Nemt') { $agent = '"Rejs Nemt" App' }
|
|
if($agent -match 'Rejsekort/2015') { $agent = '"Rejsekort(??)" App' }
|
|
if($agent -match 'Mozilla\/5.0\+\(Windows\+NT\+[0-9]+.[0-9]+;\+WOW64;\+Trident\/7\.0;\+rv:11.0\)\+like\+Gecko') { $agent = 'Internet Explorer' }
|
|
|
|
"$os / $agent"
|
|
}} -AutoSize |