Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Binary file added .DS_Store
Binary file not shown.
1 change: 1 addition & 0 deletions .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -2,3 +2,4 @@ config.yml
*.pyc
__pycache__
logs/
output/
6 changes: 3 additions & 3 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -59,15 +59,15 @@ This script scans one or more `idp-process.log` files to see details about which

### Filenames

In both cases, the default file to analyze is the current (live) log file, as it would be named on the idpv4 servers: `/var/log/tomcat9/access.log` and `/opt/shibboleth-idp/logs/idp-process.log`. Use `-f` to specify a different filename.
The default file to analyze is the current (live) log file, as it would be named on the IdP v4 or IdP v5 server: `/opt/shibboleth-idp/logs/idp-process.log`. Use `-f` to specify a different filename.

Multiple filenames are allowed (separate by spaces), wildcards are allowed, and filenames that end in `.gz` can be processed without unzipping them.

**Example**

To get every SP that has used this IdP for authentication over the entire `logs/` directory:
To get every user and service provider that has used this IdP for authentication over the entire `logs/` directory:
```bash
./logscan.py sp -f /opt/shibboleth-idp/logs/idp-process*
./logscan.py -f /opt/shibboleth-idp/logs/idp-process*
```

### Options
Expand Down
71 changes: 61 additions & 10 deletions logscan.py
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@

from argparse import ArgumentParser
from parsers import ShibbolethLog
import os


def help(args):
Expand All @@ -11,24 +12,74 @@ def help(args):
def scan(args):
kwargs = {
'principal': args.principal,
'requester': args.requester
'requester': args.requester,
# 'sso': args.sso,
'daily': args.daily,
'output': args.output,
}
log = ShibbolethLog(**kwargs)
for filename in args.filename:
log.load(filename)
log.command_scan()


def main(args):
if args.output:
# If we specified an output directory, make sure it exists.
output_dir = os.path.join(os.getcwd(), args.output)
if not os.path.exists(output_dir):
os.mkdir(output_dir)
args.output = output_dir
scan(args)


if __name__ == '__main__':
argp = ArgumentParser(
epilog='Specify neither -n nor -r to show all service providers. Specify both to see IP address and timestamp of logins.')
argp.add_argument('-f', '--filename', type=str, nargs='*',
default=['/opt/shibboleth-idp/logs/idp-process.log'],
help='Log filename(s) to process, accepts wildcards')
argp.add_argument('-n', '--principal', default=None, nargs='+',
help='Restrict to this username and list service providers')
argp.add_argument('-r', '--requester', default=None, nargs='+',
help='Restrict to this service provider and list usernames')
description='''
Scans Shib logs for instances of specified (or all) usernames
logging into specified (or all) service providers, and returns
counts as CSV of either totals or daily traffic.
''',
epilog='''
Specify neither -n nor -r to show all usernames and service
providers. Specify both to see IP address and timestamp of
all logins.''',
)

subject = argp.add_argument_group('Subjects to scan for')
subject.add_argument(
'-n', '--principal', default=None, nargs='+',
help='Limit scan to the username(s) provided')
subject.add_argument(
'-r', '--requester', default=None, nargs='+',
help='Limit scan to the service provider(s) provided')
# subject.add_argument(
# '-s', '--sso', action='store_true',
# help='Determine if SSO was used within above limits')

output = argp.add_argument_group('Output options')
# TODO: -d needs exactly one of -n or -r.
output.add_argument(
'-d', '--daily', action='store_true',
help='Provide daily usage as CSV for exactly one of -n or -r')
output.add_argument(
'-o', '--output', default=None, nargs='?',
help='Create logs of results in this output directory')
# output.add_argument(
# '-v', '--verbose', action='store_true',
# help='Provide verbose output')

targets = argp.add_argument_group('Which log files to scan')
targets.add_argument(
'-f', '--filename', type=str, nargs='*',
default=['/opt/shibboleth-idp/logs/idp-process.log'],
help='Log filename(s) to process, accepts wildcards')

args = argp.parse_args()
scan(args)
if args.daily:
if ((args.principal and args.requester)
or (not args.principal and not args.requester)):
print('The -d/--daily option requires exactly one of -n/--principal or -r/--requester')
exit(1)

main(args)
Loading