brad@bradley.UUCP (11/21/83)
#N:bradley:3800003:000:11371
bradley!brad Nov 19 20:14:00 1983
While the subject is warm? cold? or what ever the case maybe, I submit
my uucp program to the net. It analyzes just about everything (I think).
It uses it neat function I wrote called 'getfield' which returns a char
pointer to the specific field ( zero is the first ). Below is a sample
(just a few lines) of our LOGFILE & SYSLOG files. I have to run a sed
file on it to clean it up. All it does is cleans up the file so that there
are no gaps ( or extra spaces ) betweens the 'fields'. I claim that it
has no holes and could use fixing but it works.
Have fun----
Bradley Smith, Bradley University, Peoria Illinois
{ihnp4,pur-ee,parsec}!uiucdcs!bradley!brad (309) 676-7611 Ext. 446
_______________
LOGFILE:
uucp uiucdcs (11/1-5:01-13306) REQUESTED (S D.uiucdcsX12FY X.uiucdcsX12FY uucp)
uucp uiucdcs (11/1-5:01-13306) COPY (SUCCEEDED)
root uiucdcs (11/1-5:020-13319) uucp XQT (PATH=/usr/ucb:/bin:/usr/bin:/etc;rmail brad )
root uiucdcs (11/1-20:043-17492) WRONG TIME TO CALL (uiucdcs)
root uiucdcs (11/1-20:043-17492) FAILED (call to uiucdcs )
root uiucdcs (11/1-21:051-17629) NO (DEVICE)
root uiucdcs (11/1-22:03-17686) SUCCEEDED (call to uiucdcs )
root uiucdcs (11/1-22:03-17686) OK (startup)
brad uiucdcs (11/1-22:03-17686) REQUEST (S D.uiucdcsB0575 D.uiucdcsB0575 brad)
brad uiucdcs (11/1-22:03-17686) REQUESTED (CY)
_______________
SYSLOG
uucp uiucdcs (11/1-5:01) (436532504) received data 363 bytes 4 secs
uucp uiucdcs (11/1-5:01) (436532507) received data 63 bytes 2 secs
notes uiucdcs (11/1-5:02) (436532524) received data 1365 bytes 14 secs
notes uiucdcs (11/1-5:02) (436532529) received data 79 bytes 3 secs
notes uiucdcs (11/1-5:02) (436532534) received data 136 bytes 3 secs
_______________
The program;
------------------------
/*
* uucpanz.c
* program to print out stats about uucp usage.
*
* By:
* Bradley Smith
* Bradley University
* uiucdcs!bradley!brad
*/
#include <stdio.h>
#include <ctype.h>
char *getfield();
#define SYSLOG "/usr/spool/uucp/SYSLOG"
#define LOGFILE "/usr/spool/uucp/LOGFILE"
#define MAXSYS 5 /* maxuim number of systems you talk to
* should be made to use malloc but I didn't
* oh well
*/
struct dayrec {
int used; /* used */
long recv; /* bytes recv */
long sent; /* bytes sent */
long trecv; /* seconds spent rec */
long tsent; /* seconds spent sending */
};
struct sys1 { /* sturct for each system you talk to */
char sname[9];
long bbsent;
long brec;
long btsent;
long btrec;
int suc;
int fail;
int ugot;
int lock;
int usent;
};
struct users {
char *name; /* login name */
long bsent; /* bytes sent */
long utim;
struct users *nuser;
};
struct call {
int times;
char *cname;
struct call *ncall;
};
struct dayrec dayacc[13] [32];
struct sys1 sysacc[MAXSYS];
struct call *cmd, *tcall();
struct users *usage;
struct users *tree();
char *malloc(), *strsave();
long byt, tim, atol();
int cmdcount;
long hour, min,second, hourtmp;
FILE *fpin;
main()
{
char line[512], field[128], date[10], cx[128],*cp, *c;
char sysname[9], username[9];
register int i,j,k;
int d, m;
/* intialize */
usage = NULL;
cmdcount = 0;
cmd = NULL;
for(i = 1; i <= 12; i++)
for(j = 1; j <= 31; j++) {
dayacc[i][j].recv= 0L;
dayacc[i][j].used= 0;
dayacc[i][j].trecv= 0L;
dayacc[i][j].sent= 0L;
dayacc[i][j].tsent =0L;
}
/* lets do SYSLOG first */
if((fpin = fopen(SYSLOG,"r")) == NULL)
error("Can't open SYSLOG");
while(fgets(line,512,fpin) != NULL) {
/*
* lets find the date
*/
strcpy(cx,getfield(2,line,' '));
cp = &cx;
cp++; /* puts at first number */
c = cp;
cp++;
if(isdigit(*cp))
cp++;
*cp = '\0';
m = atoi(c);
cp++;
c = cp;
cp++;
if(isdigit(*cp))
cp++;
*cp = '\0';
d = atoi(c);
strcpy(sysname, getfield(1,line,' '));
byt = atol(getfield(6,line,' '));
tim = atol(getfield(8,line,' '));
strcpy(username, getfield(0,line,' '));
strcpy(field,getfield(4,line,' '));
if(tindex(field,"sent") != -1) { /* ah we are sending stuff */
for(i = 0;i < MAXSYS;i ++) {
if(strlen(sysacc[i].sname) <= 0) {
strcpy(sysacc[i].sname, sysname);
sysacc[i].bbsent = byt;
sysacc[i].btsent = tim;
break;
}
else if(strcmp(sysacc[i].sname, sysname) == 0) {
sysacc[i].bbsent += byt;
sysacc[i].btsent += tim;
break;
}
}
usage = tree(usage, username);
dayacc[m][d].sent += byt;
dayacc[m][d].tsent += tim;
dayacc[m][d].used = 1;
}
else { /* recieving stuff */
dayacc[m][d].recv += byt;
dayacc[m][d].trecv += tim;
dayacc[m][d].used = 1;
for(i=0;i< MAXSYS; i++) {
if(strlen(sysacc[i].sname) <= 0) {
strcpy(sysacc[i].sname, sysname);
sysacc[i].brec = byt;
sysacc[i].btrec = tim;
break;
}
else if(strcmp(sysacc[i].sname, sysname) == 0) {
sysacc[i].brec += byt;
sysacc[i].btrec += tim;
break;
}
}
}
}
fclose(fpin);
if((fpin = fopen(LOGFILE,"r")) == NULL )
error("Can't open LOGFILE");
while(fgets(line,512,fpin) != NULL) {
c = getfield(4,line,' ');
if(strcmp(c,"XQT") == 0) {
strcpy(field,getfield(1,line,';'));
field[strlen(field)-4] = '\0';
cmd = tcall(cmd,field);
}
else if(tindex(c,"call") != -1) {
cp = getfield(3,line,' ');
if(strcmp(cp,"SUCCEEDED") == 0) {
for(i=0;i< MAXSYS;i++)
if(strcmp(sysacc[i].sname,getfield(1,line,' ')) == 0)
sysacc[i].suc++;
}
else if(strcmp(cp,"FAILED") == 0) {
for(i=0;i< MAXSYS;i++)
if(strcmp(sysacc[i].sname,getfield(1,line,' ')) == 0)
sysacc[i].fail++;
}
else if(strcmp(cp,"LOCKED") == 0) {
for(i=0;i< MAXSYS;i++)
if(strcmp(sysacc[i].sname,getfield(1,line,' ')) == 0)
sysacc[i].lock++;
}
}
cp = getfield(3,line,' ');
if(strcmp(cp,"REQUEST") == 0) {
for(i=0;i< MAXSYS;i++)
if(strcmp(sysacc[i].sname,getfield(1,line,' ')) == 0)
sysacc[i].usent++;
}
else if(strcmp(cp,"COPY") == 0) {
for(i=0;i< MAXSYS;i++) {
if(strcmp(sysacc[i].sname,getfield(1,line,' ')) == 0)
sysacc[i].ugot++;
}
}
}
fclose(fpin);
printf("UUCP ANALYZER:\n");
printf("%5sBy system:\n","");
for(i=0;i < MAXSYS;i++) {
if(strlen(sysacc[i].sname) > 0) {
printf("%10s%s\n", "", sysacc[i].sname);
hourtmp = sysacc[i].btsent / 60; /* gives interger min */
second = sysacc[i].btsent - ( hourtmp * 60); /* seconds */
hour = hourtmp / 60; /* gives integer hour */
min = hourtmp - ( hour * 60);
printf("%15ssent %10ld bytes %5stime ", "", sysacc[i].bbsent,"");
printf("%02ld:%02ld:%02ld\n", hour, min, second);
printf("%15srecieved %10ld bytes %5stime ","",sysacc[i].brec,"");
hourtmp = sysacc[i].btrec / 60; /* gives interger min */
second = sysacc[i].btrec - ( hourtmp * 60); /* seconds */
hour = hourtmp / 60; /* gives integer hour */
min = hourtmp - ( hour * 60);
printf("%02ld:%02ld:%02ld\n", hour, min, second);
printf("%15s# of files %10d sent %5s %5d recieved\n",
"",sysacc[i].usent, "",sysacc[i].ugot);
printf("%15s# of calls %10d suc %10d fail %10d lock\n",
"", sysacc[i].suc, sysacc[i].fail, sysacc[i].lock);
/* next do total */
hour = sysacc[i].bbsent - sysacc[i].brec;
if(hour < 0) { /* means we rec more */
hour *= -1;
printf("%15srecieved %ld bytes more than sent\n",
"", hour);
}
else if(hour > 0) /* means we sent more */
printf("%15ssent %ld bytes more that recieved\n",
"", hour);
else
printf("%15ssent the same amount as recieved\n","");
hourtmp = (sysacc[i].btrec + sysacc[i].btsent) / 60;
second = (sysacc[i].btrec + sysacc[i].btsent)
- ( hourtmp * 60); /* seconds */
hour = hourtmp / 60; /* gives integer hour */
min = hourtmp - ( hour * 60);
printf("%15stotal connect time %02ld:%02ld:%02ld\n",
"", hour, min, second);
}
}
printf("\n%5sBy user:\n", "");
treeprint(usage);
printf("\n%5sBy commands:\n", "");
trsort();
tcallpr(cmd);
printf("\n%5sBy day:\n","");
for(i = 1; i <= 12; i++)
for(j = 1; j <= 31; j++) {
if(dayacc[i][j].used) {
hourtmp = dayacc[i][j].trecv / 60;
second = dayacc[i][j].trecv - ( hourtmp * 60);
hour = hourtmp / 60; /* gives integer hour */
min = hourtmp - ( hour * 60);
printf("%5s%2d/%02d ", "", i,j);
printf("recieved %8ld bytes in ", dayacc[i][j].recv);
printf("%02ld:%02ld:%02ld/sent %8ld bytes in ",
hour,min,second, dayacc[i][j].sent);
hourtmp = dayacc[i][j].tsent / 60;
second = dayacc[i][j].tsent - ( hourtmp * 60);
hour = hourtmp / 60; /* gives integer hour */
min = hourtmp - ( hour * 60);
printf("%02ld:%02ld:%02ld\n", hour,min,second);
}
}
exit(0);
}
error(s)
char *s;
{
fprintf(stderr,"%s\n", s);
exit(1);
}
tindex(s,t) /* great function from 'C' book, to lazy to use pointers */
char s[], t[];
{
register int j,k,i;
for(i=0;s[i] != '\0'; i++) {
for(j=i,k=0;t[k] != '\0' && s[j]== t[k]; j++, k++)
;
if(t[k] == '\0')
return(i);
}
return(-1);
}
char *strsave(s) /* save string s somewhere */
char *s;
{
char *p;
if((p = malloc(strlen(s)+1)) != NULL)
strcpy(p,s);
else {
error("strsave: out of mem");
}
return(p);
}
struct users *tree(p,w)
struct users *p;
char *w;
{
if(p == NULL) { /* new word */
p = (struct users *) malloc (sizeof(struct users));
p->name = strsave(w);
p->bsent = byt;
p->utim = tim;
p->nuser = NULL;
}
else if(strcmp(w,p->name) == 0) {
p->bsent += byt;
p->utim += tim;
}
else {
p->nuser = tree(p->nuser,w);
}
return(p);
}
struct call *tcall(p,w) /* basically same as above */
struct call *p;
char *w;
{
if(p == NULL) { /* new cmd */
p = (struct call *) malloc (sizeof(struct call));
if(p == NULL)
error("tcall out of Mem");
p->ncall = NULL;
p->cname = strsave(w);
p->times = 1;
cmdcount++;
}
else if(strcmp(w,p->cname) == 0) {
p->times++;
}
else {
p->ncall = tcall(p->ncall,w);
}
return(p);
}
treeprint(p)
struct users *p;
{
if(p != NULL) {
printf("%10s%10s ", "", p->name);
printf("sent %10ld bytes ", p->bsent);
hourtmp = p->utim /60;
second = p->utim - ( hourtmp * 60 );
hour = hourtmp / 60;
min = hourtmp - (hour * 60);
printf("%02ld:%02ld:%02ld\n", hour,min,second);
treeprint(p->nuser);
}
}
tcallpr(p)
struct call *p;
{
if(p != NULL ) {
printf("%10d %s\n", p->times, p->cname);
tcallpr(p->ncall);
}
}
trsort()
{
struct call *q;
struct call *p;
register int i, sw, n,m;
char *c;
char *d;
loop:
p = cmd;
sw = 0;
for(i=0;i< cmdcount-1; i++) {
q = p->ncall;
if(p->times < q->times) { /* switch */
c = p->cname;
n = p->times;
d = q->cname;
m = q->times;
p->cname = d;
p->times = m;
q->cname = c;
q->times = n;
sw = 1;
}
p = p->ncall;
}
if(sw)
goto loop;
}
/* my great function, if read this far I commend you */
#define NULLP ""
char *
getfield(field,buffer,separator)
char separator;
char buffer[];
int field;
{
register int i;
char *bp, *p, buff[512];
int sht;
sht = 0;
strcpy(buff,buffer);
p = &buff[0];
i = 0;
if((*p == separator) && (field != 0)) {
field -= 1;
sht = 1;
}
while( i != field) {
for(++p; *p != separator; p++) {
if (*p == '\0') {
return(NULLP);
}
}
i++;
}
if(sht)
field += 1;
if(field != 0) p++;
bp =p;
for (; *p != separator; p++)
if(*p == '\0')
return(bp);
*p = '\0';
return(bp);
}
/* if you read this last line your crazy, but I understand
* I wrote this last line.
*
* Brad Smith
*/david@varian.UUCP (11/23/83)
I would like to thank bradley!brad for posting his uucpanz uucp analysis
program. However, I had to make a few changes to get it to work with
our uucp: we run the 4.1BSD version of uucp, with most of the known bug fixes
installed.
The first problem was that brad's SYSLOG entries look like this:
uucp uiucdcs (11/1-5:01) (436532504) received data 363 bytes 4 secs
I don't know what the fourth field (the 9 digit number) is supposed to
mean, but our version does not have that field at all. This causes the numbering
of all succeeding fields to be off by one, so I just changed the field
numbers in the calls to getfield().
The other problem I found was that each command in the list of commands
executed (rmail, rnews, etc) was being truncated by one character. I
don't understand why it works for Brad but fails for us: possibly something
to do with the different paths that XQT uses (we use only /bin:/usr/bin;
he also uses /etc), but I fixed it by moving the placement of the string
terminator (see below).
David Brown (415) 945-2199
Varian Instruments 2700 Mitchell Dr. Walnut Creek, Ca. 94598
{ihnp4,tektronix,hplabs,sytek,dual}!zehntel!varian!david
{amd70,fortune}!varian!david
...!decvax!sytek!zehntel!varian!david
...!ucbvax!menlo70!sytek!zehntel!varian!david
-----------
*** uucpanz.c Tue Nov 22 14:00:54 1983
--- uucpanz.c.old Tue Nov 22 14:06:41 1983
***************
*** 152,159
*cp = '\0';
d = atoi(c);
strcpy(sysname, getfield(1,line,' '));
! byt = atol(getfield(5,line,' '));
! tim = atol(getfield(7,line,' '));
strcpy(username, getfield(0,line,' '));
! strcpy(field,getfield(3,line,' '));
--- 156,163 -----
*cp = '\0';
d = atoi(c);
strcpy(sysname, getfield(1,line,' '));
! byt = atol(getfield(6,line,' '));
! tim = atol(getfield(8,line,' '));
strcpy(username, getfield(0,line,' '));
! strcpy(field,getfield(4,line,' '));
***************
*** 204,210
c = getfield(4,line,' ');
if(strcmp(c,"XQT") == 0) {
strcpy(field,getfield(1,line,';'));
! field[strlen(field)-3] = '\0';
cmd = tcall(cmd,field);
}
else if(tindex(c,"call") != -1) {
--- 208,214 -----
c = getfield(4,line,' ');
if(strcmp(c,"XQT") == 0) {
strcpy(field,getfield(1,line,';'));
! field[strlen(field)-4] = '\0';
cmd = tcall(cmd,field);
}
else if(tindex(c,"call") != -1) {
END OF MESSAGEthomas@utah-gr.UUCP (Spencer W. Thomas) (11/27/83)
I, too, noticed the "extra" field in the SYSLOG file. But, two of our
systems are still running 4.1a, and the other two are running 4.2. The
4.2 sites have the extra field (still don't know what it is...).
Anyway, I decided to parametrize the whole thing. Also fixed the bug
which deleted the last character of commands. Contrary to the "warning"
in the original message, I haven't found it necessary to "clean up" the
files. Here's my diff listing:
*** /tmp/,RCSt1020959 Sat Nov 26 22:39:20 1983 (ORIGINAL)
--- uucpanz.c Tue Nov 22 11:25:01 1983
***************
*** 14,15
#define SYSLOG "/usr/spool/uucp/SYSLOG"
--- 14,21 -----
+ /* The new uucp has another field in the SYSLOG file */
+ #ifndef NEWUUCP
+ #define NEWUUCP 0
+ #else
+ #define NEWUUCP 1
+ #endif
#define SYSLOG "/usr/spool/uucp/SYSLOG"
***************
*** 15,16
#define SYSLOG "/usr/spool/uucp/SYSLOG"
#define LOGFILE "/usr/spool/uucp/LOGFILE"
--- 21,28 -----
#define SYSLOG "/usr/spool/uucp/SYSLOG"
+ #define SYSUSER 0 /* user name */
+ #define SYSNAME 1 /* System name */
+ #define SYSDATE 2 /* Date called */
+ #define SYSDIR 3+NEWUUCP /* Direction (sent/received) */
+ #define SYSBYTE 5+NEWUUCP /* Number of bytes */
+ #define SYSTIME 7+NEWUUCP /* time it took */
#define LOGFILE "/usr/spool/uucp/LOGFILE"
***************
*** 16,18
#define LOGFILE "/usr/spool/uucp/LOGFILE"
! #define MAXSYS 5 /* maxuim number of systems you talk to
* should be made to use malloc but I didn't
--- 28,35 -----
#define LOGFILE "/usr/spool/uucp/LOGFILE"
! #define LOGXQT 4 /* If XQT, this is where it says */
! #define LOGCMD 2 /* if XQT, what is command (used with ; delimiter) */
! #define LOGSTAT 3 /* SUCCEEDED, FAILED, OK, etc. */
! #define LOGSYS 1 /* system name field */
!
! #define MAXSYS 10 /* maxuim number of systems you talk to
* should be made to use malloc but I didn't
***************
*** 95,98
*/
! strcpy(cx,getfield(2,line,' '));
! cp = &cx;
cp++; /* puts at first number */
--- 112,115 -----
*/
! strcpy(cx,getfield(SYSDATE,line,' '));
! cp = cx;
cp++; /* puts at first number */
***************
*** 111,117
d = atoi(c);
! strcpy(sysname, getfield(1,line,' '));
! byt = atol(getfield(6,line,' '));
! tim = atol(getfield(8,line,' '));
! strcpy(username, getfield(0,line,' '));
! strcpy(field,getfield(4,line,' '));
--- 128,134 -----
d = atoi(c);
! strcpy(sysname, getfield(SYSNAME,line,' '));
! byt = atol(getfield(SYSBYTE,line,' '));
! tim = atol(getfield(SYSTIME,line,' '));
! strcpy(username, getfield(SYSUSER,line,' '));
! strcpy(field,getfield(SYSDIR,line,' '));
***************
*** 161,163
while(fgets(line,512,fpin) != NULL) {
! c = getfield(4,line,' ');
if(strcmp(c,"XQT") == 0) {
--- 178,180 -----
while(fgets(line,512,fpin) != NULL) {
! c = getfield(LOGXQT,line,' ');
if(strcmp(c,"XQT") == 0) {
***************
*** 163,166
if(strcmp(c,"XQT") == 0) {
! strcpy(field,getfield(1,line,';'));
! field[strlen(field)-4] = '\0';
cmd = tcall(cmd,field);
--- 180,183 -----
if(strcmp(c,"XQT") == 0) {
! strcpy(field,getfield(LOGCMD,line,';'));
! field[strlen(field)-3] = '\0';
cmd = tcall(cmd,field);
***************
*** 169,171
! cp = getfield(3,line,' ');
if(strcmp(cp,"SUCCEEDED") == 0) {
--- 186,188 -----
! cp = getfield(LOGSTAT,line,' ');
if(strcmp(cp,"SUCCEEDED") == 0) {
***************
*** 172,174
for(i=0;i< MAXSYS;i++)
! if(strcmp(sysacc[i].sname,getfield(1,line,' ')) == 0)
sysacc[i].suc++;
--- 189,191 -----
for(i=0;i< MAXSYS;i++)
! if(strcmp(sysacc[i].sname,getfield(LOGSYS,line,' ')) == 0)
sysacc[i].suc++;
***************
*** 177,179
for(i=0;i< MAXSYS;i++)
! if(strcmp(sysacc[i].sname,getfield(1,line,' ')) == 0)
sysacc[i].fail++;
--- 194,196 -----
for(i=0;i< MAXSYS;i++)
! if(strcmp(sysacc[i].sname,getfield(LOGSYS,line,' ')) == 0)
sysacc[i].fail++;
***************
*** 182,184
for(i=0;i< MAXSYS;i++)
! if(strcmp(sysacc[i].sname,getfield(1,line,' ')) == 0)
sysacc[i].lock++;
--- 199,201 -----
for(i=0;i< MAXSYS;i++)
! if(strcmp(sysacc[i].sname,getfield(LOGSYS,line,' ')) == 0)
sysacc[i].lock++;
***************
*** 186,188
}
! cp = getfield(3,line,' ');
if(strcmp(cp,"REQUEST") == 0) {
--- 203,205 -----
}
! cp = getfield(LOGSTAT,line,' ');
if(strcmp(cp,"REQUEST") == 0) {
***************
*** 189,191
for(i=0;i< MAXSYS;i++)
! if(strcmp(sysacc[i].sname,getfield(1,line,' ')) == 0)
sysacc[i].usent++;
--- 206,208 -----
for(i=0;i< MAXSYS;i++)
! if(strcmp(sysacc[i].sname,getfield(LOGSYS,line,' ')) == 0)
sysacc[i].usent++;
***************
*** 194,196
for(i=0;i< MAXSYS;i++) {
! if(strcmp(sysacc[i].sname,getfield(1,line,' ')) == 0)
sysacc[i].ugot++;
--- 211,213 -----
for(i=0;i< MAXSYS;i++) {
! if(strcmp(sysacc[i].sname,getfield(LOGSYS,line,' ')) == 0)
sysacc[i].ugot++;thomas@utah-gr.UUCP (Spencer W. Thomas) (11/29/83)
Oops. I forgot that LOGCMD should only be 1 for most people. We changed our uuxqt so that commands are executed by "PATH=...;export PATH;cmd..." =Spencer
jreuter@cincy.UUCP (Jim Reuter) (11/29/83)
That extra field in the SYSLOG file is the time as returned directly from time(). Rtiuucp has this extra field. Jim Reuter (decvax!cincy!jreuter)