apache_users

#!/bin/bash
#
# apache_users - Munin plugin, displays traffic by user
#
# Version: 03.06.2009
# Author: Rainer Wolff <rainer.wolff@gmx.com>
#
# ################################################################################ MAGIC MARKERS

#%# family=contrib
#%# capabilities=autoconf

# ####################################################################################### CONFIG

DIRECTORY=$MUNIN_PLUGSTATE/apache_users
TIMESTAMP=$DIRECTORY/.apache_users
ACCESSLOG=/var/log/apache2/access_log

# ##################################################################################### AUTOCONF

if [ "$1" = "autoconf" ]
then
	if ! ls $ACCESSLOG > /dev/null
	then
		echo "no (could not find apache access log \"$ACCESSLOG\")"
	elif ! ls $DIRECTORY > /dev/null
	then
		echo "no (could not find munin plugins directory \"$DIRECTORY\")"
	else
		echo "yes"
	fi
	exit 0
fi

# ######################################################################################### INIT

# Define regex for all possible timestamps of last 5 minutes block
REGEX=$(LC_ALL=en_US date -d "5 minutes ago" "+\[%d\/%b\/%Y:%H: %M :[0-5][0-9] %z\]" \
	| awk '{ printf "%s(%02d|%02d|%02d|%02d|%02d)%s", $1, $2-$2%5, $2-$2%5+1, $2-$2%5+2, $2-$2%5+3, $2-$2%5+4, $3 }')


# Analyse logfile
while read REQUEST_ADDR REQUEST_USERNAME REQUEST_BYTES
do
	# Name resolution for known addresses
	REQUEST_DOMAIN=$( awk '/^'"$REQUEST_ADDR"'/ { print $2 }' /etc/hosts )
	REQUEST_ADDR=${REQUEST_DOMAIN:-$REQUEST_ADDR}


	# Scan for known addresses, if found, sum up traffic
	FOUND=false
	for (( I=${#ADDR[@]}-1; I>=0; I-- ))
	do
		# Address known, name maybe, anonymous access (again)
		if [ "${ADDR[I]}" == "$REQUEST_ADDR" -a "$REQUEST_USERNAME" == "-" ]
		then
			FOUND=true
			BYTES[$I]=$(( ${BYTES[I]} + $REQUEST_BYTES ))
			break

		# Known address and name
		elif [ "${ADDR[I]}" == "$REQUEST_ADDR" -a "${USERNAME[I]}" == "$REQUEST_USERNAME" ]
		then
			FOUND=true
			BYTES[$I]=$(( ${BYTES[I]} + $REQUEST_BYTES ))
			break

		# Known address, previous access anonymous
		elif [ "${ADDR[I]}" == "$REQUEST_ADDR" -a "${USERNAME[I]}" == "-" ]
		then
			FOUND=true
			USERNAME[$I]="$REQUEST_USERNAME"
			BYTES[$I]=$(( ${BYTES[I]} + $REQUEST_BYTES ))
			break
		fi
	done

	# Combination of address and name unknown, create new entry
	if [ "$FOUND" == "false" ]
	then
		ADDR[${#ADDR[@]}]=$REQUEST_ADDR
		USERNAME[${#USERNAME[@]}]="$REQUEST_USERNAME"
		BYTES[${#BYTES[@]}]=$REQUEST_BYTES
	fi

done < <( awk '/'"$REGEX"'/ { printf "%s %s %d\n", $1, $3, $10 }' $ACCESSLOG )


# Assign anonymous access when possible and correct identifiers
for (( I=0; I<${#USERNAME[@]}; I++ ))
do
	if [ "${USERNAME[I]}" == "-" ]
	then
		if $( echo "${ADDR[I]}" | egrep -q "[^0-9.]" )
		then
			USERNAME[$I]="${ADDR[I]}"
		else
			USERNAME[$I]="anonymous"
		fi
		NAME[$I]="_${USERNAME[I]}" # Output sort order
	else
		NAME[$I]="${USERNAME[I]}"
	fi

	NAME[$I]="$( echo "${NAME[I]}" \
		| sed "s/^[^A-Za-z_]/_/" | sed "s/[^A-Za-z0-9_]/_/g" \
		| sed "s/^\(.\{,19\}\).*/\1/" )"
done

# Create timestamp
mkdir -p $DIRECTORY
touch -d "-1 second" $TIMESTAMP # find needs time span

# Aggregate parallel traffic
for (( I=0; I<${#NAME[@]}; I++ ))
do
	if [ -z "$( find $DIRECTORY -name "${NAME[I]}" -newer $TIMESTAMP )" ]
	then
		echo "${NAME[I]} ${BYTES[I]} ${USERNAME[I]}" > $DIRECTORY/${NAME[I]}
	else
		awk '{ printf "%s %d %s", $1, $2+${BYTES[I]}, $3 }' $DIRECTORY/${NAME[I]} > $DIRECTORY/${NAME[I]}
	fi
done


# ####################################################################################### CONFIG

if [ "$1" = "config" ]
then
	echo "graph_title Apache users"
	echo "graph_vlabel bytes per five minute period"
	echo "graph_args --lower-limit 1 --base 1024 --logarithmic"
	echo "graph_category webserver"
	echo "graph_total total"
	echo "graph_info Webserver traffic by user."

	FILENAMES=$( find $DIRECTORY -type f -not -wholename $TIMESTAMP | sort)

	awk '{ printf "%s.label %s\n%s.draw AREA\n", $1, $3, $1 }' $( echo "$FILENAMES" | head -n1 )

	for FILENAME in $( echo "$FILENAMES" | tail -n+2)
	do
		awk '{ printf "%s.label %s\n%s.draw STACK\n", $1, $3, $1 }' $FILENAME
	done

	exit 0
fi


# ######################################################################################## VALUE

{

for FILENAME in $( find $DIRECTORY -type f -newer $TIMESTAMP -not -wholename $TIMESTAMP )
do
	awk '{ printf "%s.value %d\n", $1, $2 }' $FILENAME
done

for FILENAME in $( find $DIRECTORY -type f -not -newer $TIMESTAMP -not -wholename $TIMESTAMP )
do
	awk '{ printf "%s.value 0\n", $1 }' $FILENAME
done

} | sort

exit 0