问题描述
我有一个任务，其中的主要任务是报告日志文件中的可疑活动。我还必须解决其他几个问题，但是我最想关注的问题是“可疑活动”（如果我能对此有所了解，那么很有可能会用一个灯泡来指导我其余的部分）。应该实现此目的的方式是在用户在12:00 am至5:00 am之间登录时保持计数。将用户标记为可疑后，应将用户名，电子邮件和域名显示为输出信息。
我以前从未使用过日志文件，这是我第一次使用Python 3（特别是PyCharm）处理日志文件。到目前为止，事实证明这具有挑战性，因为我不知道确切地从哪里开始这项任务。我最初计划使用正则表达式来匹配日志文件中的特定文本和键的字典，但是我不确定这是否是解决此分配问题的正确方法。
以下是示例日志：Sample Behavior
这是用户日志文件的一部分 userlog.log
我很抱歉，如果我发布的帖子有点混乱，这是我第一次使用Stack Overflow。我的目标是收集有关如何一次完成此任务的想法和想法。也感谢您的任何想法或想法。编辑：下面是一段用户日志文件。
2020-05-23 00:44:42登录mailserver.local [email protected]
2020-05-15 10:54:11注销mailserver.local [email protected]
2020-05-07 11:25:24登录myworkstation.local [email protected]
2020-05-14 16:31:34注销webserver.local [email protected]
2020-05-12 17:02:10登录mailserver.local [email protected]
2020-05-30 23:01:30注销mailserver.local [email protected]
2020-05-11 15:04:32注销myworkstation.local [email protected]
2020-05-26 13:51:35注销mailserver.local [email protected]
2020-05-15 02:21:39注销mailserver.local [email protected]
2020-05-05 14:16:13登录mailserver.local [email protected]
2020-05-21 03:53:37登录mailserver.local [email protected]
2020-05-05 06:17:09登录webserver.local [email protected]
2020-05-24 18:24:49注销myworkstation.local [email protected]
解决方法
要读取日志，请使用readlines获取所有文件行，对于每一行，请使用split将行划分为列。使用datetime比较时间。
要获取仍在登录的用户列表，请在登录时将其添加到列表中，然后在注销时将其删除。最后，将其余条目用于“仍然登录”列表。
尝试以下代码：
ss = '''
2020-05-23 00:44:42 login mailserver.local [email protected]
2020-05-15 10:54:11 logout mailserver.local [email protected]
2020-05-07 11:25:24 login myworkstation.local [email protected]
2020-05-14 16:31:34 logout webserver.local [email protected]
2020-05-12 17:02:10 login mailserver.local [email protected]
2020-05-30 23:01:30 logout mailserver.local [email protected]
2020-05-11 15:04:32 logout myworkstation.local [email protected]
2020-05-26 13:51:35 logout mailserver.local [email protected]
2020-05-15 02:21:39 logout mailserver.local [email protected]
2020-05-05 14:16:13 login mailserver.local [email protected]
2020-05-21 03:53:37 login mailserver.local [email protected]
2020-05-05 06:17:09 login webserver.local [email protected]
2020-05-24 18:24:49 logout myworkstation.local [email protected]
'''.strip()
with open('userlog.log','w') as f: f.write(ss) # write log file
#############################
import datetime
loggedin = set() # users still logged in
allusers = set() # all users
FiveAM = datetime.datetime.strptime('05:00:00','%H:%M:%S')
with open('userlog.log') as f:
lines = f.readlines()
for ln in lines:
cols = ln.split() # split at spaces,date is col 0,time is col 1
dt = datetime.datetime.strptime(' '.join(cols[:2]),'%Y-%m-%d %H:%M:%S') # date\time
tm = datetime.datetime.strptime(cols[1],'%H:%M:%S') # time
print(cols)
allusers.add(cols[4])
if cols[2] == 'login' and tm < FiveAM:
print('>>> Suspicious! ' + cols[4] + ' is a spy!')
if cols[2] == 'login':
loggedin.add(cols[4]) # email,add to login list
else: # logout
if cols[4] in loggedin: loggedin.remove(cols[4]) # remove from login list
print('\n-- Users logged in -- \n','\n'.join(loggedin),sep='') # users still logged in
print('\n-- Users logged out -- \n','\n'.join(allusers-loggedin),sep='') # users not still logged in
输出
['2020-05-23','00:44:42','login','mailserver.local','[email protected]']
>>> Suspicious! [email protected] is a spy!
['2020-05-15','10:54:11','logout','[email protected]']
['2020-05-07','11:25:24','myworkstation.local','[email protected]']
['2020-05-14','16:31:34','webserver.local','[email protected]']
['2020-05-12','17:02:10','[email protected]']
['2020-05-30','23:01:30','[email protected]']
['2020-05-11','15:04:32','[email protected]']
['2020-05-26','13:51:35','[email protected]']
['2020-05-15','02:21:39','[email protected]']
['2020-05-05','14:16:13','[email protected]']
['2020-05-21','03:53:37','[email protected]']
>>> Suspicious! [email protected] is a spy!
['2020-05-05','06:17:09','[email protected]']
['2020-05-24','18:24:49','[email protected]']
-- Users logged in --
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
-- Users logged out --
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]