6

这是我在 stackoverflow 上提出的第一个问题，我真的很期待成为这个社区的一员。我是编程新手，python 是很多人最推荐的第一个程序。

反正。我有一个如下所示的日志文件： 

"No.","Time","Source","Destination","Protocol","Info"
"1","0.000000","120.107.103.180","172.16.112.50","TELNET","Telnet Data ..." 
"2","0.000426","172.16.112.50","172.16.113.168","TELNET","Telnet Data ..." 
"3","0.019849","172.16.113.168","172.16.112.50","TCP","21582 > telnet [ACK]" 
"4","0.530125","172.16.113.168","172.16.112.50","TELNET","Telnet Data ..." 
"5","0.530634","172.16.112.50","172.16.113.168","TELNET","Telnet Data ..."

我想使用 Python 解析日志文件，使其看起来像这样：

从 IP 135.13.216.191 协议计数：（IMF 1）（SMTP 38）（TCP 24）（总数：63）

我真的很想得到一些帮助来解决这个问题，我应该使用列表并循环遍历它还是字典/元组？

在此先感谢您的帮助！

4

3 回答 3

9

csv您可以使用模块解析文件：

import csv

with open('logfile.txt') as logfile:
     for row in csv.reader(logfile):
         no, time, source, dest, protocol, info = row
         # do stuff with these

我不太清楚你在问什么，但我认为你想要：

import csv
from collections import defaultdict

# A dictionary whose values are by default (a
# dictionary whose values are by default 0)
bySource = defaultdict(lambda: defaultdict(lambda: 0))

with open('logfile.txt') as logfile:
     for row in csv.DictReader(logfile):
         bySource[row["Source"]][row["Protocol"]] += 1

for source, protocols in bySource.iteritems():
    protocols['Total'] = sum(protocols.values())

    print "From IP %s Protocol Count: %s" % (
        source,
        ' '.join("(%s: %d)" % item for item in protocols.iteritems())
    )
于 2012-10-24T20:12:46.313 回答
1

我首先将文件读入列表：

contents = []
with open("file_path") as f:
    contents = f.readlines()

然后，您可以将每一行拆分为它自己的列表：

ips = [l[1:-1].split('","') for l in contents]

然后我们可以将它们映射到一个字典中：

sourceIps = {}
for ip in ips:
    try:
       sourceIps[ip[2]].append(ip)
    except:
       sourceIps[ip[2]] = [ip]

最后打印出结果：

for ip, stuff in sourceIps.iteritems():
   print "From {0} ... ".format(ip, ...)
于 2012-10-24T20:13:44.820 回答
0

首先，您需要阅读文本文件

# Open the file
file = open('log_file.csv')
# readlines() will return the data as a list of strings, one for each line
log_data = file.readlines()
# close the log file
file.close()

设置一个字典来保存你的结果

results = {}

现在遍历您的数据，一次一行，并将协议记录在字典中

for entry in log_data:
    entry_data = entry.split(',')
    # We are going to have a separate entry for each source ip
    # If we haven't already seen this ip, we need to make an entry for it
    if entry_data[2] not in results:
        results[entry_data[2]] = {'total':0}
    # Now check to see if we've seen the protocol for this ip before
    # If we haven't, add a new entry set to 0
    if entry_data[4] not in results[entry_data[2]]:
         results[entry_data[2]][entry_data[4]] = 0
    # Now we increment the count for this protocol
    results[entry_data[2]][entry_data[4]] += 1
    # And we increment the total count
    results[entry_data[2]]['total'] += 1

计算完所有内容后，只需迭代计数并打印结果

for ip in results:
    # Here we're printing a string with placeholders. the {0}, {1} and {2} will be filled
    # in by the call to format
    print "from: IP {0} Protocol Count: {1})".format(
        ip,
        # And finally create the value for the protocol counts with another format call
        # The square braces with the for statement inside create a list with one entry
        # for each entry, in this case, one entry for each protocol
        # We use ' '.join to join each of the counts with a string
        ' '.join(["({0}: {1})".format(protocol, results[ip][protocol] for protocol in results[ip])]))
于 2012-10-24T20:33:01.310 回答