dieng
18 juin 2007 à 15:22
more logacs.20
May 14 20:00:36 192.168.2.1 CisACS_01_PassedAuth 1rgw406cg 1 0 Message-Type=Authen OK,User-Name=nadieng@test.lan,NAS-IP-Address=192.168.1.3,Caller-ID= 0-22-3F-BD-50-21,NAS-Port=9
May 14 20:00:38 192.168.2.1 CisACS_01_PassedAuth 1s0varqch 1 0 Message-Type=Authen OK,User-Name=mathieu@test.lan,NAS-IP-Address=192.168.1.3,Caller-ID= 0-22-B9-2F-A5-27,NAS-Port=6
May 14 20:01:36 192.168.2.1 CisACS_01_PassedAuth 9353k6ci 1 0 Message-Type=Authen OK,User-Name=nadieng@test.lan,NAS-IP-Address=192.168.1.3,Caller-ID= 0-22-3F-BD-50-21,NAS-Port=9
May 14 20:01:38 192.168.2.1 CisACS_01_PassedAuth 9n4abqcj 1 0 Message-Type=Authen OK,User-Name=mathieu@test.lan,NAS-IP-Address=192.168.1.3,Caller-ID= 0-22-B9-2F-A5-27,NAS-Port=6
May 14 20:02:36 192.168.2.1 CisACS_01_PassedAuth pqgqiuck 1 0 Message-Type=Authen OK,User-Name=nadieng@test.lan,NAS-IP-Address=192.168.1.3,Caller-ID= 0-22-3F-BD-50-21,NAS-Port=9
May 14 20:02:38 192.168.2.1 CisACS_01_PassedAuth qafxaecl 1 0 Message-Type=Authen OK,User-Name=mathieu@test.lan,NAS-IP-Address=192.168.1.3,Caller-ID= 0-22-B9-2F-A5-27,NAS-Port=6
May 14 20:03:36 192.168.2.1 CisACS_01_PassedAuth 16dsdhicm 1 0 Message-Type=Authen OK,User-Name=nadieng@test.lan,NAS-IP-Address=192.168.1.3,Caller-ID= 0-22-3F-BD-50-21,NAS-Port=9
May 14 20:03:38 192.168.2.1 CisACS_01_PassedAuth 16xrk92cn 1 0 Message-Type=Authen OK,User-Name=mathieu@test.lan,NAS-IP-Address=192.168.1.3,Caller-ID= 0-22-B9-2F-A5-27,NAS-Port=6
May 14 20:04:36 192.168.2.1 CisACS_01_PassedAuth 1n140g6co 1 0 Message-Type=Authen OK,User-Name=nadieng@test.lan,NAS-IP-Address=192.168.1.3,Caller-ID= 0-22-3F-BD-50-21,NAS-Port=9
May 14 20:04:38 192.168.2.1 CisACS_01_PassedAuth 1nl377qcp 1 0 Message-Type=Authen OK,User-Name=mathieu@test.lan,NAS-IP-Address=192.168.1.3,Caller-ID= 0-22-B9-2F-A5-27,NAS-Port=6
May 14 20:05:36 192.168.2.1 CisACS_01_PassedAuth 4nd006cq 1 0 Message-Type=Authen OK,User-Name=nadieng@test.lan,NAS-IP-Address=192.168.1.3,Caller-ID= 0-22-3F-BD-50-21,NAS-Port=9
May 14 20:05:38 192.168.2.1 CisACS_01_PassedAuth 57c6rqcr 1 0 Message-Type=Authen OK,User-Name=mathieu@test.lan,NAS-IP-Address=192.168.1.3,Caller-ID= 0-22-B9-2F-A5-27,NAS-Port=6
May 14 20:06:36 192.168.2.1 CisACS_01_PassedAuth laomyucs 1 0 Message-Type=Authen OK,User-Name=nadieng@test.lan,NAS-IP-Address=192.168.1.3,Caller-ID= 0-22-3F-BD-50-21,NAS-Port=9
more logdhcp.20
ogdhcp.20May 14 20:04:38 syslogserver dhcpd: Wrote 2 leases to leases file.
May 14 20:04:38 syslogserver dhcpd: DHCPREQUEST for 192.168.0.1 from 00:22:3f:bd:50:21 (Client_ACS) via eth0
May 14 20:04:38 syslogserver dhcpd: DHCPACK on 192.168.0.1 to 00:22:3f:bd:50:21 (Client_ACS) via eth0
May 14 20:04:41 syslogserver dhcpd: DHCPREQUEST for 192.168.0.2 from 00:22:b9:2f:a5:27 (toto8) via eth0
May 14 20:04:41 syslogserver dhcpd: DHCPACK on 192.168.0.2 to 00:22:b9:2f:a5:27 (toto8) via eth0
May 14 20:34:38 syslogserver dhcpd: DHCPREQUEST for 192.168.0.1 from 00:22:3f:bd:50:21 (Client_ACS) via eth0
May 14 20:34:38 syslogserver dhcpd: DHCPACK on 192.168.0.1 to 00:22:3f:bd:50:21 (Client_ACS) via eth0
May 14 20:34:41 syslogserver dhcpd: DHCPREQUEST for 192.168.0.2 from 00:22:b9:2f:a5:27 (toto8) via eth0
May 14 20:34:41 syslogserver dhcpd: DHCPACK on 192.168.0.2 to 00:22:b9:2f:a5:27 (toto8) via eth0
script:
tempo_file1="/tmp/fichier.txt"
tempo_file2="/tmp/verif.txt"
perm_file="trace"
dir="/var/log/"
cat logacs.20 | grep ".*PassedAuth" | awk 'BEGIN{FS=","} {print $2 "," $4}' | awk 'BEGIN{FS=","} {n=split($1,tab,"="); print tab[n] "," $2;}' | awk 'BEGIN{FS=","} {n=split($2,tab,"="); print tab[n] " " $1;}' | tr 'A-Z' 'a-z' | sed -e 's/-/:/g;s/^ /0/' > ${tempo_file1}
# recuperation infos dans fichier logdhcp en fonction @MAC de ACS
echo -e "USER\t\t\tMAC\t\t\tIP\t\tANNEE\tMOIS\tJOUR\tHEURE" > "${dir}/${perm_file}"
while read ligne
do
set $ligne
mac=${1}
user=${2}
grep ${mac} logdhcp.20 | grep "DHCPACK" >> ${tempo_file2}
# on recherche à partir de l'@ MAC( fichier tempo-file) dans le fichier DHCP, tous les lignes qui ont DHCPACK
# tempo_file2 ne contient que les lignes de logdhcp qui sont des acknowledges
while read autre_ligne
do
set $autre_ligne
ip=${8}
mois=${1}
jour=${2}
heure=${3}
echo -e "$user\t$mac\t$ip\t$year\t$mois\t$jour\t$heure" >> "${dir}/${perm_file}"
done < ${tempo_file2}
done < ${tempo_file1}
sauf que j'ai ça comme résultat:
USER MAC IP ANNEE MOIS JOUR HEURE
cnestestnadieng 00:22:3f:bd:50:21 192.168.0.1 2007 May 14 20:04:38
cnestestnadieng 00:22:3f:bd:50:21 192.168.0.1 2007 May 14 20:04:41
cnestestnadieng 00:22:3f:bd:50:21 192.168.0.1 2007 MAy 14 20:34:48
cnestestnadieng 00:22:3f:bd:50:21 192.168.0.1 2007 MAy 14 20:34:41
cnestestmathieu 00:22:b9:2f:a5:27 192.168.0.2 2007 May 14 20:04:38
cnestestmathieu 00:22:b9:2f:a5:27 192.168.0.2 2007 May 14 20:04:41
cnestestmathieu 00:22:b9:2f:a5:27 192.168.0.2 2007 MAy 14 20:34:48
cnestestmathieu 00:22:b9:2f:a5:27 192.168.0.2 2007 MAy 14 20:34:41
au lieu:
USER MAC IP ANNEE MOIS JOUR HEURE
cnestestnadieng 00:22:3f:bd:50:21 192.168.0.1 2007 May 14 20:04:38
cnestestmathieu 00:22:b9:2f:a5:27 192.168.0.2 2007 May 14 20:04:41
cnestestnadieng 00:22:3f:bd:50:21 192.168.0.1 2007 May 14 20:34:38
cnestestmathieu 00:22:b9:2f:a5:27 192.168.0.2 2007 May 14 20:34:41
j'ai décidé de récuperer aussi l'heure du fichier acs et de l'ajouter comme paramètre de recherche de l'adresse IP en plus de l'adresse MAC.
cat logacs.20 | grep ".*PassedAuth" | awk 'BEGIN{FS=","} {print $1 "," $2 "," $4}' | awk 'BEGIN{FS=","}{m=split($1,tab," ");print tab[3] "," $2 "," $3;}' | sed -e 's/(.*\)/\1:\2/' #| awk 'BEGIN{FS=","} {n=split($2,tab,"="); print tab[n] "," $1 "," $3;}' | awk 'BEGIN{FS=","} {n=split($3,tab,"="); print tab[n] " " $2 " " $1;}' | tr 'A-Z' 'a-z' | sed -e 's/-/:/g;s/^ /0/' > "$tempo_file1"
Thanks for your help.