#!/usr/bin/perl
#
# Simple perl program for summarising samba syslog output - expected on stdin
# Looks for copied files 
#
# Built for samba (linux)
#
# Ferry van Doorn
# March 2001
# contact:f.g.vandoorn@student.utwente.nl
#
# The original, which is used en heavilly changed code, comes from the following persons:
#
# Built for 1.9.18p10 and Solaris 2.5.1 - elsewhere YMMV
#
# $Header: /a/biela/vol/fileservers/biela/biela2/sufolk/peter/release/samba/RCS/samba-syslog.pl,v 1.1 99/02/16 16:17:24 peter Exp Locker: peter $
#
# $Log:	samba-syslog.pl,v $
# Revision 1.1  99/02/16  16:17:24  peter
# Initial revision
# 
#
# Peter Polkinghorne, Brunel University, UK.
#
# Copyright (C) 1999
#
# License GPL - see COPYING in the Samba distribution
#
# Source location: ftp://ftp.brunel.ac.uk/cc/peter/samba/
# contact: peter.polkinghorne@brunel.ac.uk
#
#
# Rebuilt for Debian 2.2
# Coen Giesberts
# January 2001
# contact: c.c.m.giesberts@student.utwente.nl
#


######################################################

# declarations

# minimal count that the open_file arguments occur for one file
$minoccur=2;

$lasthost = "";
$lastfile = "";

# process arguments

# handy modules
use Getopt::Std;
 
# allow for debug flag
if ( ! getopts('d') || @ARGV == 0 ) {
        die "Usage: $0 [-d] [files...]";
} elsif ( $opt_d ) {
        $debug = 1;
} else {
        $debug = 0;
}
 
#######################################################
# header line
print  "DATE\t\t\tHOST\t\tFILE\n";


# process data
while ( <> ) {

# looking for a line with open_file
# - based on Debian 2.2 samba logfile
# [YYYY/MM/DD HH:MM:SS, 1] smbd/open.c:open_file(602)
# (netbios_name) opened file (file)
  
	if (/^\[(\d+)\/(\d+)\/(\d+) (\d+):(\d+):(\d+),.+?smbd\/open.c:open_file/) {
	    $date = "$1/$2/$3 $4:$5:$6";
	    $_ = <>;
	    if (/^\s+(.+?)\s+?opened file (.+?)\s+read/) {
		$host = $1;
      		if (length $host < 12) { $host = "$host\t";}
		$file = $2;
	    }

	    $debug && print STDERR
	    "open_file: $host opens file $file at $date\n";
	    
	    # hostname with the same file appears only ones in the output
	    # and only if the occurrence of the file is larger as $minoccur
	    if (($host,$file) ne ($lasthost,$lastfile)){
		$occurrence = 1;
	    } else {
		if ($occurrence == $minoccur) {
		    print "$date\t$host\t$file\n";
		}
		$occurrence += 1;
	    }    
	}
	$lasthost = $host;
	$lastfile = $file;
}

# end of samba-log-file.pl