log.c

一个网络流量分析的完整的程序

    fprintf(fd, "\n%lu seconds running time\n", nsecs);
    fflush(fd);
}

void writedstatlog(char *ifname, int unit, float activity, float pps,
		   float peakactivity, float peakpps,
		   float peakactivity_in, float peakpps_in,
		   float peakactivity_out, float peakpps_out,
		   struct iftotals *ts, unsigned long nsecs, FILE * fd)
{
    char atime[TIME_TARGET_MAX];
    char unitstring[7];

    dispmode(unit, unitstring);

    genatime(time((time_t *) NULL), atime);

    fprintf(fd,
	    "\n*** Detailed statistics for interface %s, generated %s\n\n",
	    ifname, atime);

    fprintf(fd, "Total: \t%llu packets, %llu bytes\n", ts->total,
	    ts->bytestotal);
    fprintf(fd,
	    "\t(incoming: %llu packets, %llu bytes; outgoing: %llu packets, %llu bytes)\n",
	    ts->total_in, ts->bytestotal_in, ts->total_out,
	    ts->bytestotal_out);
    fprintf(fd, "IP: \t%llu packets, %llu bytes\n", ts->iptotal,
	    ts->ipbtotal);
    fprintf(fd,
	    "\t(incoming: %llu packets, %llu bytes; outgoing: %llu packets, %llu bytes)\n",
	    ts->iptotal_in, ts->ipbtotal_in, ts->iptotal_out,
	    ts->ipbtotal_out);
    fprintf(fd, "TCP: %llu packets, %llu bytes\n", ts->tcptotal,
	    ts->tcpbtotal);
    fprintf(fd,
	    "\t(incoming: %llu packets, %llu bytes; outgoing: %llu packets, %llu bytes)\n",
	    ts->tcptotal_in, ts->tcpbtotal_in, ts->tcptotal_out,
	    ts->tcpbtotal_out);
    fprintf(fd, "UDP: %llu packets, %llu bytes\n", ts->udptotal,
	    ts->udpbtotal);
    fprintf(fd,
	    "\t(incoming: %llu packets, %llu bytes; outgoing: %llu packets, %llu bytes)\n",
	    ts->udptotal_in, ts->udpbtotal_in, ts->udptotal_out,
	    ts->udpbtotal_out);
    fprintf(fd, "ICMP: %llu packets, %llu bytes\n", ts->icmptotal,
	    ts->icmpbtotal);
    fprintf(fd,
	    "\t(incoming: %llu packets, %llu bytes; outgoing: %llu packets, %llu bytes)\n",
	    ts->icmptotal_in, ts->icmpbtotal_in, ts->icmptotal_out,
	    ts->icmpbtotal_out);
    fprintf(fd, "Other IP: %llu packets, %llu bytes\n", ts->othtotal,
	    ts->othbtotal);
    fprintf(fd,
	    "\t(incoming: %llu packets, %llu bytes; outgoing: %llu packets, %llu bytes)\n",
	    ts->othtotal_in, ts->othbtotal_in, ts->othtotal_out,
	    ts->othbtotal_out);
    fprintf(fd, "Non-IP: %llu packets, %llu bytes\n", ts->noniptotal,
	    ts->nonipbtotal);
    fprintf(fd,
	    "\t(incoming: %llu packets, %llu bytes; outgoing: %llu packets, %llu bytes)\n",
	    ts->noniptotal_in, ts->nonipbtotal_in, ts->noniptotal_out,
	    ts->nonipbtotal_out);
    fprintf(fd, "Broadcast: %llu packets, %llu bytes\n", ts->bcast, ts->bcastbytes);

    if (nsecs > 5) {
	fprintf(fd, "\nAverage rates:\n");

	if (unit == KBITS) {
	    fprintf(fd, "  Total:\t%.2f kbits/s, %.2f packets/s\n",
		    ((float) (ts->bytestotal * 8 / 1000) / (float) nsecs),
		    ((float) (ts->total) / (float) nsecs));
	    fprintf(fd, "  Incoming:\t%.2f kbits/s, %.2f packets/s\n",
		    (float) (ts->bytestotal_in * 8 / 1000) /
		    (float) (nsecs),
		    (float) (ts->total_in) / (float) (nsecs));
	    fprintf(fd, "  Outgoing:\t%.2f kbits/s, %.2f packets/s\n",
		    (float) (ts->bytestotal_out * 8 / 1000) /
		    (float) (nsecs),
		    (float) (ts->total_out) / (float) (nsecs));
	} else {
	    fprintf(fd, "%.2f kbytes/s, %.2f packets/s\n",
		    ((float) (ts->bytestotal / 1024) / (float) nsecs),
		    ((float) (ts->total) / (float) nsecs));
	    fprintf(fd, "Incoming:\t%.2f kbytes/s, %.2f packets/s\n",
		    (float) (ts->bytestotal_in / 1024) / (float) (nsecs),
		    (float) (ts->total_in) / (float) (nsecs));
	    fprintf(fd, "Outgoing:\t%.2f kbytes/s, %.2f packets/s\n",
		    (float) (ts->bytestotal_out / 1024) / (float) (nsecs),
		    (float) (ts->total_out) / (float) (nsecs));

	}
	fprintf(fd, "\nPeak total activity: %.2f %s/s, %.2f packets/s\n",
		peakactivity, unitstring, peakpps);
	fprintf(fd, "Peak incoming rate: %.2f %s/s, %.2f packets/s\n",
		peakactivity_in, unitstring, peakpps_in);
	fprintf(fd, "Peak outgoing rate: %.2f %s/s, %.2f packets/s\n\n",
		peakactivity_out, unitstring, peakpps_out);
    }
    fprintf(fd, "IP checksum errors: %lu\n\n", ts->badtotal);
    fprintf(fd, "Running time: %lu seconds\n", nsecs);
    fflush(fd);
}

void writeutslog(struct portlistent *list, unsigned long nsecs, int units,
    FILE * fd)
{
    char atime[TIME_TARGET_MAX];
    struct portlistent *ptmp = list;
    char unitstring[10];
    float inrate, outrate, totalrate;
    time_t now = time(NULL);
        
    dispmode(units, unitstring);
    
    genatime(time((time_t *) NULL), atime);

    fprintf(fd, "\n*** TCP/UDP traffic log, generated %s\n\n", atime);

    while (ptmp != NULL) {
        if (now - ptmp->proto_starttime < 5)
            inrate = outrate = totalrate = -1.0;
        else {
            if (units == KBITS) {
                inrate = (float) (ptmp->ibcount * 8 / 1000) / (float) (now - ptmp->proto_starttime);
                outrate = (float) (ptmp->obcount * 8 / 1000) / (float) (now - ptmp->proto_starttime);
                totalrate = (float) (ptmp->bcount * 8 / 1000) / (float) (now - ptmp->proto_starttime);
            } else {
                inrate = (float) (ptmp->obcount / 1024) / (float) (now - ptmp->proto_starttime);
                outrate = (float) (ptmp->obcount / 1024) / (float) (now - ptmp->proto_starttime);
                totalrate = (float) (ptmp->obcount / 1024) / (float) (now - ptmp->proto_starttime);
            }
        }
        
	if (ptmp->protocol == IPPROTO_TCP)
	    fprintf(fd, "TCP/%s: ", ptmp->servname);
	else
	    fprintf(fd, "UDP/%s: ", ptmp->servname);

	fprintf(fd, "%llu packets, %llu bytes total", ptmp->count,
		ptmp->bcount);

        if (totalrate >= 0.0)
            fprintf(fd, ", %.2f %s/s", totalrate, unitstring);
            
	fprintf(fd, "; %llu packets, %llu bytes incoming", ptmp->icount,
		ptmp->ibcount);

        if (inrate >= 0.0)
            fprintf(fd, ", %.2f %s/s", inrate, unitstring);
            
	fprintf(fd, "; %llu packets, %llu bytes outgoing", ptmp->ocount,
		ptmp->obcount);

        if (outrate >= 0.0)
            fprintf(fd, ", %.2f %s/s", outrate, unitstring);
            
        fprintf(fd, "\n\n");
	ptmp = ptmp->next_entry;
    }

    fprintf(fd, "\nRunning time: %lu seconds\n", nsecs);
    fflush(fd);
}

void writeethlog(struct ethtabent *list, int unit, unsigned long nsecs,
		 FILE * fd)
{
    char atime[TIME_TARGET_MAX];
    struct ethtabent *ptmp = list;
    char unitstring[7];

    dispmode(unit, unitstring);

    genatime(time((time_t *) NULL), atime);

    fprintf(fd, "\n*** LAN traffic log, generated %s\n\n", atime);

    while (ptmp != NULL) {
	if (ptmp->type == 0) {
	    if (ptmp->un.desc.linktype == LINK_ETHERNET)
		fprintf(fd, "\nEthernet address: %s",
			ptmp->un.desc.ascaddr);
	    else if (ptmp->un.desc.linktype == LINK_PLIP)
		fprintf(fd, "\nPLIP address: %s", ptmp->un.desc.ascaddr);
	    else if (ptmp->un.desc.linktype == LINK_FDDI)
		fprintf(fd, "\nFDDI address: %s", ptmp->un.desc.ascaddr);

	    if (ptmp->un.desc.withdesc)
		fprintf(fd, " (%s)", ptmp->un.desc.desc);

	    fprintf(fd, "\n");
	} else {
	    fprintf(fd,
		    "\tIncoming total %llu packets, %llu bytes; %llu IP packets\n",
		    ptmp->un.figs.inpcount, ptmp->un.figs.inbcount,
		    ptmp->un.figs.inippcount);
	    fprintf(fd,
		    "\tOutgoing total %llu packets, %llu bytes; %llu IP packets\n",
		    ptmp->un.figs.outpcount, ptmp->un.figs.outbcount,
		    ptmp->un.figs.outippcount);

	    fprintf(fd, "\tAverage rates: ");
	    if (unit == KBITS)
		fprintf(fd,
			"%.2f kbits/s incoming, %.2f kbits/s outgoing\n",
			(float) (ptmp->un.figs.inbcount * 8 / 1000) /
			(float) nsecs,
			(float) (ptmp->un.figs.outbcount * 8 / 1000) /
			(float) nsecs);
	    else
		fprintf(fd,
			"%.2f kbytes/s incoming, %.2f kbytes/s outgoing\n",
			(float) (ptmp->un.figs.inbcount / 1024) /
			(float) nsecs,
			(float) (ptmp->un.figs.outbcount / 1024) /
			(float) nsecs);

	    if (nsecs > 5)
		fprintf(fd,
			"\tLast 5-second rates: %.2f %s/s incoming, %.2f %s/s outgoing\n",
			ptmp->un.figs.inrate, unitstring,
			ptmp->un.figs.outrate, unitstring);
	}

	ptmp = ptmp->next_entry;
    }

    fprintf(fd, "\nRunning time: %lu seconds\n", nsecs);
    fflush(fd);
}

void write_size_log(struct ifstat_brackets *brackets, unsigned long nsecs,
		    char *ifname, unsigned int mtu, FILE * logfile)
{
    char atime[TIME_TARGET_MAX];
    int i;

    genatime(time((time_t *) NULL), atime);
    fprintf(logfile, "*** Packet Size Distribution, generated %s\n\n",
	    atime);
    fprintf(logfile, "Interface: %s   MTU: %u\n\n", ifname, mtu);
    fprintf(logfile, "Packet Size (bytes)\tCount\n");

    for (i = 0; i <= 19; i++) {
	fprintf(logfile, "%u to %u:\t\t%lu\n", brackets[i].floor,
		brackets[i].ceil, brackets[i].count);
    }
    fprintf(logfile, "\nRunning time: %lu seconds\n", nsecs);
    fflush(logfile);
}


void rotate_logfile(FILE ** fd, char *name)
{
    fclose(*fd);
    *fd = fopen(name, "a");
    rotate_flag = 0;
}


void announce_rotate_prepare(FILE * fd)
{
    writelog(1, fd,
	     "***** USR1 signal received, preparing to reopen log file *****");
}

void announce_rotate_complete(FILE * fd)
{
    writelog(1, fd, "***** Logfile reopened *****");
}

void check_rotate_flag(FILE ** logfile, int logging)
{
    if ((rotate_flag == 1) && (logging)) {
	announce_rotate_prepare(*logfile);
	rotate_logfile(logfile, target_logname);
	announce_rotate_complete(*logfile);
	rotate_flag = 0;
    }
}