devbox
酷酷是懒虫
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

网络安全-华为华三交换机防火墙日志解析示例_华三ips的日志格式说明

作者：酷酷是懒虫 | 2024-07-27 21:11:16

赞

踩

华三ips的日志格式说明

DEF_SYSLOG_SWITCH_HUAWEI.py

华为交换机日志解析示例

  1. # -*- coding: utf8 -*-
  2. import time
  3. from DEF_COLOR import *   ## 终端显示颜色
  4.  
  5.  
  6. def 时间戳_2_时间文本(时间戳, 时间文本格式='%Y-%m-%d %H:%M:%S'):
  7.     #时间文本格式 = '%Y-%m-%d %H:%M:%S'
  8.     时间类 = time.localtime(时间戳)
  9.     时间文本 = time.strftime(时间文本格式, 时间类)
  10.     return(时间文本)
  11.  
  12. ## 适用于需要在SYSLOG的时间上加上时区才能和本地时间相等的情况
  13. def 日志时间转时间戳(时间文本, 加时区):
  14.     时间戳 = time.mktime(time.strptime(时间文本, '%Y-%m-%dT%H:%M:%S'))+(3600*加时区)
  15.     return(时间戳)
  16.  
  17. ## 2022-11-28T19:00:51+08:00 主机名 %%01SHELL/5/LOGOUT(s)[3918]: The user succeeded in logging out of VTY0. (UserType=SSH, UserName=xxx, Ip=xxx.xxx.xxx.xxx, VpnName=)
  18. def LOG_TYPE(LINE_TEXT):
  19.     A = LINE_TEXT.find('%%')
  20.     if A != -1:
  21.         #打印_黄(LINE_TEXT[A:])
  22.         B = LINE_TEXT.find('(', A)
  23.         if B != -1:
  24.             #打印_绿(LINE_TEXT[B:])
  25.             C = LINE_TEXT.find(' ', B)  ## 找日志正文开始位置标志
  26.             if C != -1:
  27.                 #打印_蓝(LINE_TEXT[C:])
  28.                 #打印_青(LINE_TEXT[A+4:B])
  29.                 SP = LINE_TEXT[A+4:B].split('/')
  30.                 return((SP[0], SP[2], C+1))
  31.             else:
  32.                 打印_红(f"找位置标志' '失败(日志正文开始位) {LINE_TEXT}")
  33.                 return((' -1', LINE_TEXT[A:B], -1))
  34.         else:
  35.             打印_红(f"找位置标志'('失败 {LINE_TEXT}")
  36.             return((LINE_TEXT[:A], '(-1', -1))
  37.     else:
  38.         A2 = LINE_TEXT.find(': OID')
  39.         if A2 != -1:
  40.             SP = LINE_TEXT[:A2].split()[-1].split('/')
  41.             return((SP[0], SP[2], A2+1))
  42.         else:
  43.             打印_红(f"找位置标志'%%'失败且查找': OID'也失败 {LINE_TEXT}")
  44.             return(('%-1', LINE_TEXT, -1))
  45.  
  46. # %%01ACLE/4/ACLLOG(l)[xxx]: Acl 3997 deny GigabitEthernet0/0/10 xxxx-xxxx-xxxx -> xxxx-xxxx-xxxx udp x.x.x.x(63877) -> 239.255.255.250(1900) (1 packet).
  47. # %%01ACLE/4/ACLLOG(l)[xxx]: Acl 3997 deny GigabitEthernet0/0/10 xxxx-xxxx-xxxx -> xxxx-xxxx-xxxx igmp x.x.x.x -> 224.0.0.22 (4 packets).
  48. # %%01ACLE/4/ACLLOG(l)[xxx]: Acl      deny GigabitEthernet0/0/14 xxxx-xxxx-xxxx -> xxxx-xxxx-xxxx tcp x.x.x.x(60559) -> x.x.x.x(80) (1 packet).
  49. def ACLE_ACLLOG(D_SYSLOG_SWITCH_HUAWEI, LOG_MSG):
  50.     SP = LOG_MSG.split()
  51.     if len(SP) == 11:
  52.         SP = ['X'] + SP     # 偶尔会丢个 acl id 补齐列表长度 'GigabitEthernet0/0/14 Acl'
  53.     ACL_ID = SP[1]
  54.     ACL_ST = SP[2]
  55.     ACL_IF = SP[3]
  56.     SMAC = SP[4]
  57.     DMAC = SP[6]
  58.     PT  = SP[7]
  59.     SIP = SP[8].split('(')[0]   # 不记录源端口号
  60.     DIP = SP[10].split('(')[0]  # 不记录目的端口号
  61.     COUNT = int(SP[11][1:])
  62.     K = (ACL_IF, ACL_ST, PT, f"{SIP}({SMAC})", f"{DIP}({DMAC})", ACL_ID)
  63.     if K in D_SYSLOG_SWITCH_HUAWEI['D_ACL']['ACLE']:
  64.         D_SYSLOG_SWITCH_HUAWEI['D_ACL']['ACLE'][K] += COUNT
  65.     else:
  66.         D_SYSLOG_SWITCH_HUAWEI['D_ACL']['ACLE'][K] = COUNT
  67.  
  68. # SACL/4/ACLLOG(l)[9487]: Acl 3996 applied Interface GigabitEthernet0/0/6 permit (15591 packets).
  69. # SACL/4/ACLLOG(l)[6146]: Acl 3992 applied Interface  permit (2 packets).
  70. # SACL/4/ACLLOG(l)[6112]: Acl 3992 applied Interface GigabitEthernet0/0/14 permit (174757578 packets).
  71. def SACL_ACLLOG(D_SYSLOG_SWITCH_HUAWEI, LOG_MSG):
  72.     try:
  73.         SP = LOG_MSG.split()
  74.         if len(SP) == 7:
  75.             ACL_ID = SP[1]
  76.             ACL_IF = SP[4]
  77.             ACL_ST = SP[5]
  78.             COUNT = int(SP[6][1:])
  79.         elif len(SP) == 6:
  80.             ACL_ID = SP[1]
  81.             ACL_IF = 'un'
  82.             ACL_ST = SP[4]
  83.             COUNT = int(SP[5][1:])
  84.         else:
  85.             打印_红(f"ERROR LOG_MSG={LOG_MSG} SP={SP} len(SP)={len(SP)}")
  86.         
  87.         K = (ACL_IF, ACL_ST, ACL_ID)
  88.         if K in D_SYSLOG_SWITCH_HUAWEI['D_ACL']['SACL']:
  89.             D_SYSLOG_SWITCH_HUAWEI['D_ACL']['SACL'][K] += COUNT
  90.         else:
  91.             D_SYSLOG_SWITCH_HUAWEI['D_ACL']['SACL'][K] = COUNT
  92.     except Exception as e:
  93.         打印_红(f"ERROR {e} LOG_MSG={LOG_MSG} SP={SP} len(SP)={len(SP)}")
  94.     else:
  95.         pass
  96.  
  97. ## 解析SYSLOG日志一行内容
  98. def LINE_HUAWEI(D_SYSLOG_SWITCH_HUAWEI, LINE_TEXT, TIME_LOCAL):
  99.     TP1, TP2, X = LOG_TYPE(LINE_TEXT)
  100.     if TP1 == 'ACLE':
  101.         if TP2 == 'ACLLOG':
  102.             #打印_黄(LINE_TEXT[X:-1])
  103.             ACLE_ACLLOG(D_SYSLOG_SWITCH_HUAWEI, LINE_TEXT[X:-10])
  104.         else:
  105.             return((1, TP1, TP2))   ## 终止，不做解析，返回标识代码及日志类型信息
  106.     elif TP1 == 'SACL':
  107.         if TP2 == 'ACLLOG':
  108.             SACL_ACLLOG(D_SYSLOG_SWITCH_HUAWEI, LINE_TEXT[X:-10])
  109.         else:
  110.             return((1, TP1, TP2))
  111.     elif TP1 == 'SHELL':
  112.         if TP2 == 'LOGIN':                                 # The user succeeded in logging in to VTY0. (UserType=SSH, UserName=xxx, AuthenticationMethod="Local-user", Ip=xxx.xxx.xxx.xxx, VpnName=)
  113.             SP = LINE_TEXT[X:-1].split(',')
  114.             UserType = SP[0].split('=')[-1]
  115.             UserName = SP[1].split('=')[-1]
  116.             IP = SP[3].split('=')[-1]
  117.             D_SYSLOG_SWITCH_HUAWEI['L_LOGIN'].append((TIME_LOCAL, 'LOGIN', UserType, UserName, IP))
  118.         elif TP2 == 'LOGOUT':                              # The user succeeded in logging out of VTY0. (UserType=SSH, UserName=xxx, Ip=xxx.xxx.xxx.xxx, VpnName=)
  119.             #print(TP1,TP2,LINE_TEXT[X:-1])
  120.             SP = LINE_TEXT[X:-1].split(',')
  121.             UserType = SP[0].split('=')[-1]
  122.             UserName = SP[1].split('=')[-1]
  123.             IP = SP[2].split('=')[-1]
  124.             D_SYSLOG_SWITCH_HUAWEI['L_LOGIN'].append((TIME_LOCAL, 'LOGOUT', UserType, UserName, IP))
  125.         elif TP2 in ('DISPLAY_CMDRECORD', 'CMDRECORD'):    # %%01SHELL/6/DISPLAY_CMDRECORD(s)[1869]: Recorded display command information. (Task=VT0, Ip=x.x.x.x, VpnName=, User=xx, AuthenticationMethod="Local-user", Command="display stp brief")
  126.             SP = LINE_TEXT[X:].split(',')
  127.             IP = SP[1].split('=')[-1]
  128.             USER = SP[3].split('=')[-1]
  129.             CMD = SP[5].split('=')[-1][:-2]
  130.             #打印_青(f"(SHELL, {TP2}) {TIME_LOCAL} {IP} {USER} {CMD}")
  131.             D_SYSLOG_SWITCH_HUAWEI['L_CMD'].append((TIME_LOCAL, IP, USER, CMD))
  132.         elif TP2 == 'CMDCONFIRM_UNIFORMRECORD':            # %%01SHELL/6/CMDCONFIRM_UNIFORMRECORD(s)[1867]: Record command information. (Task=VT0, IP=x.x.x.x, VpnName=, User=xx, Command="", PromptInfo="The password needs to be changed. Change now? [Y/N]:", UserInput=N)
  133.             SP = LINE_TEXT[X:].split(',')
  134.             IP = SP[1].split('=')[-1]
  135.             USER = SP[3].split('=')[-1]
  136.             PromptInfo = SP[5].split('=')[-1]
  137.             UserInput = SP[6].split('=')[-1][:-2]
  138.             CMD = f"{PromptInfo} {UserInput}"
  139.             #打印_青(f"(SHELL, {TP2}) {TIME_LOCAL} {IP} {USER} {CMD}")
  140.             D_SYSLOG_SWITCH_HUAWEI['L_CMD'].append((TIME_LOCAL, IP, USER, CMD))
  141.         else:
  142.             return((1, TP1, TP2))
  143.     elif TP1 == 'IFPDT':
  144.         if TP2 == 'PKT_OUTDISCARD_ABNL':    ## 端口【出】方向丢包达到报警阈值
  145.             SP = LINE_TEXT[X:].split(',')
  146.             #for i in SP:
  147.             #    print(i)
  148.             SW_IF = SP[0].split('=')[-1]
  149.             SW_DROP = SP[1].split('=')[-1]
  150.             #print(SW_IF, SW_DROP, 'OUT')
  151.             D_SYSLOG_SWITCH_HUAWEI['L_IF_DROP'].append((TIME_LOCAL, SW_IF, SW_DROP, 'OUT', '丢包超过阈值'))
  152.         elif TP2 == 'PKT_OUTDISCARD_NL':    ## 端口【出】方向恢复正常
  153.             SP = LINE_TEXT[X:].split(',')
  154.             SW_IF = SP[0].split('=')[-1]
  155.             SW_DROP = SP[1].split('=')[-1]
  156.             #print(SW_IF, SW_DROP, 'OUT')
  157.             D_SYSLOG_SWITCH_HUAWEI['L_IF_DROP'].append((TIME_LOCAL, SW_IF, SW_DROP, 'OUT', '恢复'))
  158.         elif TP2 == 'PKT_INDISCARD_ABNL':   ## 端口【入】方向丢包达到报警阈值
  159.             SP = LINE_TEXT[X:].split(',')
  160.             #for i in SP:
  161.             #    print(i)
  162.             SW_IF = SP[0].split('=')[-1]
  163.             SW_DROP = SP[1].split('=')[-1]
  164.             #print(SW_IF, SW_DROP, 'IN')
  165.             D_SYSLOG_SWITCH_HUAWEI['L_IF_DROP'].append((TIME_LOCAL, SW_IF, SW_DROP, 'IN', '丢包超过阈值'))
  166.         elif TP2 == 'PKT_INDISCARD_NL':     ## 端口【入】方向恢复正常
  167.             SP = LINE_TEXT[X:].split(',')
  168.             SW_IF = SP[0].split('=')[-1]
  169.             SW_DROP = SP[1].split('=')[-1]
  170.             #print(SW_IF, SW_DROP, 'IN')
  171.             D_SYSLOG_SWITCH_HUAWEI['L_IF_DROP'].append((TIME_LOCAL, SW_IF, SW_DROP, 'IN', '恢复'))
  172.         elif TP2 == 'IF_STATE':
  173.             SP = LINE_TEXT[X:].split()
  174.             IF_ID = SP[1]
  175.             IF_ST = SP[5]
  176.             if IF_ID not in D_SYSLOG_SWITCH_HUAWEI['D_IF_PHY']:
  177.                 D_SYSLOG_SWITCH_HUAWEI['D_IF_PHY'][IF_ID] = []
  178.             D_SYSLOG_SWITCH_HUAWEI['D_IF_PHY'][IF_ID].append((TIME_LOCAL, IF_ST))
  179.         else:
  180.             return((1, TP1, TP2))
  181.     elif TP1 == 'SECE':
  182.         D_SYSLOG_SWITCH_HUAWEI['L_SECE'].append(LINE_TEXT)
  183.     elif TP1 == 'MSTP':
  184.         D_SYSLOG_SWITCH_HUAWEI['L_STP'].append((TIME_LOCAL, LINE_TEXT[X:-1]))
  185.     elif TP1 == 'IFNET':
  186.         print('IFNET', TP2, TIME_LOCAL, LINE_TEXT[X:-1])
  187.     elif TP1 == 'IFADP':
  188.         print('IFADP', TP2, TIME_LOCAL, LINE_TEXT[X:-1])
  189.     elif TP1 == 'SSH':
  190.         if TP2 == 'SSH_TRANS_FILE_FINISH':
  191.             D_SYSLOG_SWITCH_HUAWEI['L_FTP'].append((TIME_LOCAL, LINE_TEXT[X:-1]))
  192.         else:
  193.             return((1, TP1, TP2))
  194.     elif TP1 == 'VTY':
  195.         print('VTY', LINE_TEXT)
  196.     else:
  197.         return((1, TP1, TP2))
  198.     return((0, TP1, TP2))
  199.  
  200. ## 解析SYSLOG日志文件
  201. def FILE_HUAWEI(D_SYSLOG_SWITCH_HUAWEI, FILE_PATH, TIME_STAMP_MIN, TIME_STAMP_MAX):
  202.     #print("RUN", FILE_PATH, TIME_STAMP_MIN, TIME_STAMP_MAX)
  203.     TIME_S = time.time()
  204.     TOT_N = 0
  205.     SELECT_N = 0
  206.     解析数量 = 0
  207.     for LINE_BYTES in open(FILE_PATH, mode='br'):
  208.         TOT_N += 1
  209.         try:
  210.             LINE_TEXT = LINE_BYTES.decode('UTF-8')
  211.         except Exception as e:
  212.             打印_红(f"ERROR {TOT_N} LINE_BYTES={LINE_BYTES} {e}")
  213.         else:
  214.             TIME_UTC = LINE_TEXT[:19]
  215.             #TIME_STAMP = time.mktime(time.strptime(TIME_UTC, '%Y-%m-%dT%H:%M:%S'))+28800
  216.             TIME_STAMP = 日志时间转时间戳(TIME_UTC, 8)
  217.             TIME_LOCAL = time.strftime('%Y-%m-%d %H:%M:%S', time.localtime(TIME_STAMP))
  218.             if TIME_STAMP_MIN < TIME_STAMP < TIME_STAMP_MAX:
  219.                 SELECT_N += 1
  220.                 #print(TIME_UTC, TIME_LOCAL, 'RUN')
  221.                 ST,TP1,TP2 = LINE_HUAWEI(D_SYSLOG_SWITCH_HUAWEI, LINE_TEXT, TIME_LOCAL)
  222.                 if ST != 0:
  223.                     #打印_红(f"{TOT_N} 未知LOG")
  224.                     #break
  225.                     if (TP1,TP2) in D_SYSLOG_SWITCH_HUAWEI['D_LOG_OTHER']:
  226.                         D_SYSLOG_SWITCH_HUAWEI['D_LOG_OTHER'][(TP1,TP2)] += 1
  227.                     else:
  228.                         D_SYSLOG_SWITCH_HUAWEI['D_LOG_OTHER'][(TP1,TP2)] = 1
  229.                 else:
  230.                     解析数量 += 1
  231.             else:
  232.                 #print(TIME_UTC, TIME_LOCAL, 'PASS')
  233.                 pass
  234.     TIME_RUN = time.time() - TIME_S
  235.     #打印_绿(f"{FILE_PATH} 完成 处理日志数量 {SELECT_N}/{TOT_N} 筛选数/总日志数 用时={TIME_RUN:.2f}秒")
  236.     return((FILE_PATH, TIME_STAMP_MIN, TIME_STAMP_MAX, TOT_N, SELECT_N, 解析数量, TIME_RUN))
  237.  
  238.  
  239.  
  240.  
  241. def SYSLOG_SWITCH_HUAWEI(FILE_PATH, SHOW=0):
  242.     D_SYSLOG_SWITCH_HUAWEI = {}
  243.     D_SYSLOG_SWITCH_HUAWEI['D_ACL'] = {'ACLE':{}, 'SACL':{}} # ACL规则匹配记录
  244.     D_SYSLOG_SWITCH_HUAWEI['D_IF_PHY'] = {}  # 接口物理断开记录
  245.     D_SYSLOG_SWITCH_HUAWEI['D_IF_LINK'] = {} # 接口链路断开记录
  246.     D_SYSLOG_SWITCH_HUAWEI['L_CMD'] = []     # 用户执行命令记录
  247.     D_SYSLOG_SWITCH_HUAWEI['L_LOGIN'] = []   # 登录信息
  248.     D_SYSLOG_SWITCH_HUAWEI['L_STP'] = []     # 生成树信息
  249.     D_SYSLOG_SWITCH_HUAWEI['L_IF_DROP'] = [] # 接口丢包
  250.     D_SYSLOG_SWITCH_HUAWEI['L_SECE'] = []    # 安全事件
  251.     D_SYSLOG_SWITCH_HUAWEI['L_FTP'] = []
  252.     D_SYSLOG_SWITCH_HUAWEI['D_LOG_OTHER'] = {} # 未解析日志记录
  253.     
  254.     TIME_STAMP_MIN = 0
  255.     TIME_STAMP_MAX = time.time()    # 默认为当前时间戳
  256.     R = FILE_HUAWEI(D_SYSLOG_SWITCH_HUAWEI, FILE_PATH, TIME_STAMP_MIN, TIME_STAMP_MAX)
  257.     if SHOW == 1:
  258.         打印_黄("端口丢包 (D_SYSLOG_SWITCH_HUAWEI['L_IF_DROP'])")
  259.         for TIME, SW_IF, SW_DROP, IN_OUT, PS in D_SYSLOG_SWITCH_HUAWEI['L_IF_DROP']:
  260.             if PS == '恢复':
  261.                 打印_绿(f"    {TIME} {SW_IF} {SW_DROP} {IN_OUT:3s} {PS}")
  262.             else:
  263.                 打印_红(f"    {TIME} {SW_IF} {SW_DROP} {IN_OUT:3s} {PS}")
  264.         
  265.         打印_黄("设备安全 (D_SYSLOG_SWITCH_HUAWEI['L_SECE'])")
  266.         for i in D_SYSLOG_SWITCH_HUAWEI['L_SECE']:
  267.             打印_红(f"    {i}")
  268.         
  269.         打印_黄("备份配置 (D_SYSLOG_SWITCH_HUAWEI['L_FTP'])")
  270.         for i in D_SYSLOG_SWITCH_HUAWEI['L_FTP']:
  271.             打印_青(f"    {i}")
  272.         
  273.         打印_黄("生成树   (D_SYSLOG_SWITCH_HUAWEI['L_STP'])")
  274.         for i in D_SYSLOG_SWITCH_HUAWEI['L_STP']:
  275.             打印_红(f"    {i}")
  276.         
  277.         打印_黄("访问规则 (D_SYSLOG_SWITCH_HUAWEI['D_ACL'])")
  278.         for K1 in D_SYSLOG_SWITCH_HUAWEI['D_ACL']:
  279.             if K1 == 'ACLE':
  280.                 L_K2 = [i for i in D_SYSLOG_SWITCH_HUAWEI['D_ACL'][K1]]
  281.                 L_K2.sort()
  282.                 for K2 in L_K2:
  283.                     ACL_IF, ACL_ST, PT, SIPSMAC, DIPDMAC, ACL_ID = K2
  284.                     if ACL_ST == 'deny':
  285.                         打印_红(f"{D_SYSLOG_SWITCH_HUAWEI['D_ACL'][K1][K2]:8} {ACL_IF:21} {ACL_ID:4s} {ACL_ST:5s} {PT:4s} {SIPSMAC:31s} -> {DIPDMAC}")
  286.                     else:
  287.                         打印_绿(f"{D_SYSLOG_SWITCH_HUAWEI['D_ACL'][K1][K2]:8} {ACL_IF:21} {ACL_ID:4s} {ACL_ST:5s} {PT:4s} {SIPSMAC:31s} -> {DIPDMAC}")
  288.             elif K1 == 'SACL':
  289.                 L_K2 = [i for i in D_SYSLOG_SWITCH_HUAWEI['D_ACL'][K1]]
  290.                 L_K2.sort()
  291.                 for K2 in L_K2:
  292.                     ACL_IF, ACL_ST, ACL_ID = K2
  293.                     if ACL_ST == 'deny':
  294.                         打印_红(f"{D_SYSLOG_SWITCH_HUAWEI['D_ACL'][K1][K2]:8} {ACL_IF:21} {ACL_ST:5s}")
  295.                     else:
  296.                         打印_绿(f"{D_SYSLOG_SWITCH_HUAWEI['D_ACL'][K1][K2]:8} {ACL_IF:21} {ACL_ST:5s}")
  297.             
  298.         打印_黄("接口物理状态 (D_SYSLOG_SWITCH_HUAWEI['D_IF_PHY'])")
  299.         for K in D_SYSLOG_SWITCH_HUAWEI['D_IF_PHY']:
  300.             print(f"    {K:21s} DOWN/UP 次数 {len(D_SYSLOG_SWITCH_HUAWEI['D_IF_PHY'][K])}")
  301.             for TIME_LOCAL, IF_ST in D_SYSLOG_SWITCH_HUAWEI['D_IF_PHY'][K]:
  302.                 if IF_ST == 'DOWN':
  303.                     打印_红(f"        {TIME_LOCAL} DOWN")
  304.                 else:
  305.                     打印_绿(f"        {TIME_LOCAL} {IF_ST}")
  306.         
  307.         #打印_黄("接口逻辑状态 (D_SYSLOG_SWITCH_HUAWEI['D_IF_LINK'])")
  308.         #for K in D_SYSLOG_SWITCH_HUAWEI['D_IF_LINK']:
  309.         #    print(f"    {K:21s} DOWN/UP 次数 {len(D_SYSLOG_SWITCH_HUAWEI['D_IF_LINK'][K])}")
  310.         
  311.         打印_黄("登录登出详细 (D_SYSLOG_SWITCH_HUAWEI['L_LOGIN'])")
  312.         for TIME_LOCAL, ST, UserType, UserName, IP in D_SYSLOG_SWITCH_HUAWEI['L_LOGIN']:
  313.             if ST == 'LOGIN':
  314.                 打印_青(f"    {TIME_LOCAL} {IP:15s} {ST:6s} {UserType} {UserName}")
  315.             elif ST == 'LOGOUT':
  316.                 打印_蓝(f"    {TIME_LOCAL} {IP:15s} {ST:6s} {UserType} {UserName}")
  317.             else:
  318.                 打印_红(f"    {TIME_LOCAL} {IP:15s} {ST:6s} {UserType} {UserName}")
  319.         
  320.         打印_黄("操作命令 (D_SYSLOG_SWITCH_HUAWEI['L_CMD'])")
  321.         for TIME_LOCAL, IP, USER, CMD in D_SYSLOG_SWITCH_HUAWEI['L_CMD']:
  322.             打印_青(f"    {TIME_LOCAL} {IP:15s} {USER:8s} {CMD}")
  323.         
  324.         打印_黄("忽略解析日志 (D_SYSLOG_SWITCH_HUAWEI['D_LOG_OTHER'])")
  325.         L_K = [i for i in D_SYSLOG_SWITCH_HUAWEI['D_LOG_OTHER']]
  326.         L_K.sort()
  327.         for K in L_K:
  328.             print(f"{D_SYSLOG_SWITCH_HUAWEI['D_LOG_OTHER'][K]:5} {K}")
  329.         
  330.         FILE_PATH, TIME_STAMP_MIN, TIME_STAMP_MAX, TOT_N, SELECT_N, 解析数量, TIME_RUN = R
  331.         时间文本格式 = '%Y-%m-%d %H:%M:%S'
  332.         打印_红(f"日志路径 : {FILE_PATH}")
  333.         打印_青(f"开始/结束: {时间戳_2_时间文本(TIME_STAMP_MIN, 时间文本格式)} / {时间戳_2_时间文本(TIME_STAMP_MAX, 时间文本格式)}")
  334.         打印_绿(f"解析/筛选/总数: {解析数量}/{SELECT_N}/{TOT_N} {(解析数量/TOT_N)*100:.2f}(%)/{(SELECT_N/TOT_N)*100:.2f}(%)/100(%)  用时: {TIME_RUN:.2f}秒")
  335.     
  336.     ## 返回需要的信息(ACL放行或阻止统计)
  337.     D_RETURN = {'PERMIT':{}, 'DENY':{}, 'OTHER':{}}
  338.     
  339.     #print(D_SYSLOG_SWITCH_HUAWEI['D_ACL']['ACLE'])
  340.     for K in D_SYSLOG_SWITCH_HUAWEI['D_ACL']['ACLE']:
  341.         ACL_IF = K[0]
  342.         ACL_ST = K[1]
  343.         ACL_ID = K[5]
  344.         KEY_NEW = f"{ACL_IF} {ACL_ID}"
  345.         if ACL_ST.upper() == 'PERMIT':
  346.             if KEY_NEW not in D_RETURN['PERMIT']:
  347.                 D_RETURN['PERMIT'][KEY_NEW] = 0
  348.             D_RETURN['PERMIT'][KEY_NEW] += D_SYSLOG_SWITCH_HUAWEI['D_ACL']['ACLE'][K]
  349.         elif ACL_ST.upper() == 'DENY':
  350.             if KEY_NEW not in D_RETURN['DENY']:
  351.                 D_RETURN['DENY'][KEY_NEW] = 0
  352.             D_RETURN['DENY'][KEY_NEW] += D_SYSLOG_SWITCH_HUAWEI['D_ACL']['ACLE'][K]
  353.         else:
  354.             if KEY_NEW not in D_RETURN['OTHER']:
  355.                 D_RETURN['OTHER'][KEY_NEW] = 0
  356.             D_RETURN['OTHER'][KEY_NEW] += D_SYSLOG_SWITCH_HUAWEI['D_ACL']['ACLE'][K]
  357.     
  358.     #print(D_SYSLOG_SWITCH_HUAWEI['D_ACL']['SACL'])
  359.     for K in D_SYSLOG_SWITCH_HUAWEI['D_ACL']['SACL']:
  360.         ACL_IF, ACL_ST, ACL_ID = K
  361.         KEY_NEW = f"{ACL_IF} {ACL_ID}"
  362.         if ACL_ST.upper() == 'PERMIT':
  363.             D_RETURN['PERMIT'][KEY_NEW] = D_SYSLOG_SWITCH_HUAWEI['D_ACL']['SACL'][K]
  364.         elif ACL_ST.upper() == 'DENY':
  365.             D_RETURN['DENY'][KEY_NEW] = D_SYSLOG_SWITCH_HUAWEI['D_ACL']['SACL'][K]
  366.         else:
  367.             D_RETURN['OTHER'][KEY_NEW] = D_SYSLOG_SWITCH_HUAWEI['D_ACL']['SACL'][K]
  368.     
  369.     return(D_RETURN)
  370.  
  371. if __name__ == '__main__':
  372.     FILE_PATH = '华为交换机日志文件路径'
  373.     SHOW = 1    # 查看重要日志信息
  374.     D_ACL_INFO = SYSLOG_SWITCH_HUAWEI(FILE_PATH, SHOW)
  375.     print(D_ACL_INFO)

DEF_SYSLOG_SWITCH_H3C.py

华三交换机日志示例

  1. # -*- coding: utf8 -*-
  2. import time
  3. from DEF_COLOR import *   ## 终端显示颜色
  4.  
  5. def 时间戳_2_时间文本(时间戳, 时间文本格式='%Y-%m-%d %H:%M:%S'):
  6.     #时间文本格式 = '%Y-%m-%d %H:%M:%S'
  7.     时间类 = time.localtime(时间戳)
  8.     时间文本 = time.strftime(时间文本格式, 时间类)
  9.     return(时间文本)
  10.  
  11. def 日志时间转时间戳(时间文本):
  12.     时间戳 = time.mktime(time.strptime(时间文本, '%Y-%m-%dT%H:%M:%S'))
  13.     return(时间戳)
  14.  
  15. def 参数时间转时间戳(TEXT):
  16.     SP_DATE = TEXT.split('T')
  17.     if len(SP_DATE) == 2:
  18.         DATE = SP_DATE[0]
  19.         SP_TIME = SP_DATE[1].split(':')
  20.         if len(SP_TIME) == 1:
  21.             M_TIME = '%H'
  22.         elif len(SP_TIME) == 2:
  23.             M_TIME = '%H:%M'
  24.         elif len(SP_TIME) == 3:
  25.             M_TIME = '%H:%M:%S'
  26.         DATE_TIME = TEXT
  27.     else:
  28.         DATE = time.strftime('%Y-%m-%d')
  29.         SP_TIME = TEXT.split(':')
  30.         if len(SP_TIME) == 1:
  31.             M_TIME = '%H'
  32.         elif len(SP_TIME) == 2:
  33.             M_TIME = '%H:%M'
  34.         elif len(SP_TIME) == 3:
  35.             M_TIME = '%H:%M:%S'
  36.         DATE_TIME = f"{DATE}T{TEXT}"
  37.     #print(f"TEXT={TEXT}")
  38.     #print(f"DATE={DATE}")
  39.     #print(f"M_TIME={M_TIME}")
  40.     #print(f"DATE_TIME={DATE_TIME}")
  41.     M_DATE_TIME = f"%Y-%m-%dT{M_TIME}"
  42.     TIME_STAMP = time.mktime(time.strptime(DATE_TIME, M_DATE_TIME))
  43.     #print(f"TIME_STAMP={TIME_STAMP}")
  44.     return(TIME_STAMP)
  45.  
  46. def 转时间戳(TEXT):
  47.     SP_DATE = TEXT.split('T')
  48.     if len(SP_DATE) == 2:
  49.         DATE = SP_DATE[0]
  50.         SP_TIME = SP_DATE[1].split(':')
  51.         if len(SP_TIME) == 1:
  52.             M_TIME = '%H'
  53.         elif len(SP_TIME) == 2:
  54.             M_TIME = '%H:%M'
  55.         elif len(SP_TIME) == 3:
  56.             M_TIME = '%H:%M:%S'
  57.         DATE_TIME = TEXT
  58.     else:
  59.         DATE = time.strftime('%Y-%m-%d')
  60.         SP_TIME = TEXT.split(':')
  61.         if len(SP_TIME) == 1:
  62.             M_TIME = '%H'
  63.         elif len(SP_TIME) == 2:
  64.             M_TIME = '%H:%M'
  65.         elif len(SP_TIME) == 3:
  66.             M_TIME = '%H:%M:%S'
  67.         DATE_TIME = f"{DATE}T{TEXT}"
  68.     #print(f"TEXT={TEXT}")
  69.     #print(f"DATE={DATE}")
  70.     #print(f"M_TIME={M_TIME}")
  71.     print(f"DATE_TIME={DATE_TIME}")
  72.     M_DATE_TIME = f"%Y-%m-%dT{M_TIME}"
  73.     TIME_STAMP = time.mktime(time.strptime(DATE_TIME, M_DATE_TIME))
  74.     #print(f"TIME_STAMP={TIME_STAMP}")
  75.     return(TIME_STAMP)
  76.  
  77. def LOG_TYPE(LINE_TEXT):
  78.     A = LINE_TEXT.find('%%')         # 主机名 %%10ACL/6/PFILTER_STATIS_INFO: GigabitEthernet1/0/25 (outbound): Packet-filter 
  79.     if A != -1:
  80.         #打印_黄(LINE_TEXT[A:])
  81.         B = LINE_TEXT.find(':', A)   # 找日志类型结尾标识符号
  82.         if B != -1:
  83.             #打印_绿(LINE_TEXT[B:])
  84.             SP = LINE_TEXT[A+4:B].split('/')    # CFGMAN/4/TRAP(t)
  85.             if SP[2][-1] == ')':
  86.                 IDX = SP[2].find('(')
  87.                 if IDX != -1:
  88.                     return((SP[0], SP[2][:IDX], B+1))
  89.                 else:
  90.                     return((SP[0], SP[2], B+1))
  91.             else:
  92.                 return((SP[0], SP[2], B+1))
  93.         else:
  94.             打印_红(f"找位置标志':'失败(日志类型结尾标识) {LINE_TEXT}")
  95.             return((A, ':-1', -1))
  96.     else:
  97.         打印_红(f"找位置标志'%%' {LINE_TEXT}")
  98.         return(('%%-1', LINE_TEXT, -1))
  99.  
  100. ##GigabitEthernet1/0/3 (outbound): Packet-filter 2205 rule 97 deny source 192.168.0.0 0.0.255.255 logging 14 packet(s).
  101. ##GigabitEthernet1/0/3 (inbound):  Packet-filter name in_log rule 40 permit ip destination 192.168.0.0 0.0.255.255 logging 20 packet(s).
  102. def ACL_PFILTER_STATIS_INFO(D_SYSLOG_SWITCH_H3C, LOG_MSG):
  103.     try:
  104.         IDX_1 = LOG_MSG.index(': Packet-filter ')
  105.         IDX_2 = LOG_MSG.index('logging')
  106.         IDX_3 = LOG_MSG.index(' packet')
  107.     except:
  108.         打印_红(f"ERR {LOG_MSG}")
  109.     else:
  110.         SW_IF = LOG_MSG[:IDX_1]
  111.         if LOG_MSG[IDX_1+16:IDX_1+20] == 'name':
  112.             RULE = LOG_MSG[IDX_1+21:IDX_2-1]
  113.         else:
  114.             RULE = LOG_MSG[IDX_1+16:IDX_2-1]
  115.         NCOUNT = int(LOG_MSG[IDX_2+8:IDX_3])
  116.         #打印_绿(f"|{SW_IF}|{RULE}|{NCOUNT}|")
  117.         if (SW_IF, RULE) in D_SYSLOG_SWITCH_H3C['D_ACL_LOG_IPv4']:
  118.             D_SYSLOG_SWITCH_H3C['D_ACL_LOG_IPv4'][(SW_IF, RULE)] += NCOUNT
  119.         else:
  120.             D_SYSLOG_SWITCH_H3C['D_ACL_LOG_IPv4'][(SW_IF, RULE)] = NCOUNT
  121.  
  122. ##GigabitEthernet1/0/5 (inbound): Packet-filter IPv6 name ipv6_deny_in rule 0 deny logging 129 packet(s).
  123. ##GigabitEthernet1/0/5 (inbound): Packet-filter IPv6 name ipv6_deny_in rule 0 deny logging 752 packet(s).
  124. ##GigabitEthernet1/0/2 (inbound): Packet-filter IPv6 name ipv6_deny_in rule 0 deny logging 12 packet(s).
  125. def ACL_PFILTER_IPV6_STATIS_INFO(D_SYSLOG_SWITCH_H3C, LOG_MSG):
  126.     ##打印_黄(LOG_MSG)
  127.     try:
  128.         IDX_1 = LOG_MSG.index(': Packet-filter ')
  129.         IDX_2 = LOG_MSG.index('logging')
  130.         IDX_3 = LOG_MSG.index(' packet')
  131.     except:
  132.         打印_红(f"ERR {LOG_MSG}")
  133.     else:
  134.         SW_IF = LOG_MSG[:IDX_1]
  135.         #print(f"SW_IF={SW_IF}")
  136.         if LOG_MSG[IDX_1+21:IDX_1+25] == 'name':
  137.             #print(f"LOG_MSG[IDX_1+26:IDX_2-1]={LOG_MSG[IDX_1+26:IDX_2-1]}")
  138.             RULE = LOG_MSG[IDX_1+26:IDX_2-1]
  139.         else:
  140.             RULE = LOG_MSG[IDX_1+21:IDX_2-1]
  141.         NCOUNT = int(LOG_MSG[IDX_2+8:IDX_3])
  142.         #打印_绿(f"|{SW_IF}|{RULE}|{NCOUNT}|")
  143.         if (SW_IF, RULE) in D_SYSLOG_SWITCH_H3C['D_ACL_LOG_IPv6']:
  144.             D_SYSLOG_SWITCH_H3C['D_ACL_LOG_IPv6'][(SW_IF, RULE)] += NCOUNT
  145.         else:
  146.             D_SYSLOG_SWITCH_H3C['D_ACL_LOG_IPv6'][(SW_IF, RULE)] = NCOUNT
  147.  
  148. ## ARP 超过阈值
  149. ##The ARP packet rate(6 pps) exceeded the rate limit(5 pps) on interface GigabitEthernet1/0/19 in the last 60 seconds.
  150. ##The ARP packet rate(118 pps) exceeded the rate limit(100 pps) on interface GigabitEthernet1/0/25 in the last 60 seconds.
  151. ##The ARP packet rate(100 pps) exceeded the rate limit(100 pps) on interface GigabitEthernet1/0/25 in the last 60 seconds.
  152. def ARP_RATE_EXCEEDED(D_SYSLOG_SWITCH_H3C, LOG_MSG):
  153.     SP = LOG_MSG.split()
  154.     实际 = SP[3]
  155.     限制 = SP[8]
  156.     接口 = SP[12]
  157.     实际值 = int(实际[5:])
  158.     限制值 = int(限制[6:])
  159.     #print(f"{实际}|{实际值}|{限制}|{限制值}|{接口}")
  160.     if (接口,限制值) in D_SYSLOG_SWITCH_H3C['D_ARP_EXCEEDED']:
  161.         D_SYSLOG_SWITCH_H3C['D_ARP_EXCEEDED'][(接口,限制值)]+= 实际值
  162.     else:
  163.         D_SYSLOG_SWITCH_H3C['D_ARP_EXCEEDED'][(接口,限制值)] = 实际值
  164.  
  165. ## 广播超阈值次数（广播风暴）
  166. ##GigabitEthernet1/0/21 is in normal status, BC flux exceeds its upper threshold 5 pps.
  167. def STORM_CONSTRAIN_EXCEED(D_SYSLOG_SWITCH_H3C, LOG_MSG):
  168.     接口 = LOG_MSG.split()[0]
  169.     if 接口 in D_SYSLOG_SWITCH_H3C['D_STORM_CONSTRAIN_EXCEED']:
  170.         D_SYSLOG_SWITCH_H3C['D_STORM_CONSTRAIN_EXCEED'][接口]+= 1
  171.     else:
  172.         D_SYSLOG_SWITCH_H3C['D_STORM_CONSTRAIN_EXCEED'][接口] = 1
  173.  
  174. ## 解析SYSLOG日志一行内容
  175. def LINE_H3C(D_SYSLOG_SWITCH_H3C, LINE_TEXT, TIME_LOCAL):
  176.     TP1, TP2, X = LOG_TYPE(LINE_TEXT)
  177.     if TP1 == 'ACL':
  178.         if TP2 == 'PFILTER_STATIS_INFO':
  179.             #打印_黄(LINE_TEXT[X:-1])
  180.             ACL_PFILTER_STATIS_INFO(D_SYSLOG_SWITCH_H3C, LINE_TEXT[X+1:])
  181.         elif TP2 == 'PFILTER_IPV6_STATIS_INFO':
  182.             ACL_PFILTER_IPV6_STATIS_INFO(D_SYSLOG_SWITCH_H3C, LINE_TEXT[X+1:])
  183.         else:
  184.             return((1, TP1, TP2))           ## 终止，不做解析，返回标识代码及日志类型信息
  185.     elif TP1 == 'IFNET':
  186.         if TP2 == 'PHY_UPDOWN':             ## Physical state on the interface GigabitEthernet1/0/8 changed to down.
  187.             #打印_黄(LINE_TEXT[X+1:-1])
  188.             SP = LINE_TEXT[X+1:-1].split()
  189.             IF_ID = SP[5]
  190.             IF_ST = SP[-1]
  191.             #print(f'PHY  {IF_ID:21s} {IF_ST:5s} {TIME_LOCAL}')
  192.             if IF_ID not in D_SYSLOG_SWITCH_H3C['D_IF_PHY']:
  193.                 D_SYSLOG_SWITCH_H3C['D_IF_PHY'][IF_ID] = []
  194.             D_SYSLOG_SWITCH_H3C['D_IF_PHY'][IF_ID].append((TIME_LOCAL, IF_ST))
  195.         elif TP2 == 'LINK_UPDOWN':          ## Line protocol state on the interface GigabitEthernet1/0/8 changed to down.
  196.             #打印_黄(LINE_TEXT[X+1:-1])
  197.             SP = LINE_TEXT[X+1:-1].split()
  198.             IF_ID = SP[6]
  199.             IF_ST = SP[-1]
  200.             #print(f'LINK {IF_ID:21s} {IF_ST:5s} {TIME_LOCAL}')
  201.             if IF_ID not in D_SYSLOG_SWITCH_H3C['D_IF_LINK']:
  202.                 D_SYSLOG_SWITCH_H3C['D_IF_LINK'][IF_ID] = []
  203.             D_SYSLOG_SWITCH_H3C['D_IF_LINK'][IF_ID].append((TIME_LOCAL, IF_ST))
  204.         elif TP2 == 'STORM_CONSTRAIN_EXCEED':
  205.             STORM_CONSTRAIN_EXCEED(D_SYSLOG_SWITCH_H3C, LINE_TEXT[X+1:])
  206.         elif TP2 == 'STORM_CONSTRAIN_BELOW':
  207.             #print(LINE_TEXT)
  208.             pass
  209.         else:
  210.             return((1, TP1, TP2))
  211.     elif TP1 == 'LLDP':
  212.         if TP2 == 'LLDP_CREATE_NEIGHBOR':   ## Nearest bridge agent neighbor created on port GigabitEthernet1/0/10 (IfIndex 10), neighbor's chassis ID is xxxx-xxxx-xxxx, port ID is xxxx-xxxx-xxxx.
  213.             SP = LINE_TEXT[X+1:-1].split()
  214.             IF_ID  = SP[7]
  215.             IF_MAC = SP[14]
  216.             D_SYSLOG_SWITCH_H3C['L_LLDP'].append((TIME_LOCAL, 'CREATE', IF_ID, IF_MAC))
  217.         elif TP2 == 'LLDP_DELETE_NEIGHBOR': ## Nearest bridge agent neighbor deleted on port GigabitEthernet1/0/6 (IfIndex 6), neighbor's chassis ID is xxxx-xxxx-xxxx, port ID is xxxx-xxxx-xxxx.
  218.             SP = LINE_TEXT[X+1:-1].split()
  219.             IF_ID  = SP[7]
  220.             IF_MAC = SP[14]
  221.             D_SYSLOG_SWITCH_H3C['L_LLDP'].append((TIME_LOCAL, 'DELETE', IF_ID, IF_MAC))
  222.         else:
  223.             return((1, TP1, TP2))
  224.     elif TP1 == 'SSHS':
  225.         if TP2 == 'SSHS_LOG':               ## Accepted password for xxx from xxx.xxx.xxx.xxx port 55598.
  226.             pass
  227.             #打印_红(LINE_TEXT.rstrip('\n'))
  228.         elif TP2 == 'SSHS_SFTP_OPER':
  229.             #打印_黄(LINE_TEXT[X+1:-1])
  230.             D_SYSLOG_SWITCH_H3C['L_FTP'].append((TIME_LOCAL, LINE_TEXT[X+1:-1]))
  231.         else:
  232.             return((1, TP1, TP2))
  233.     elif TP1 == 'SHELL':
  234.         if TP2 == 'SHELL_CMD':               ## -Line=vty0-IPAddr=xxx.xxx.xxx.xxx-User=xxx; Command is dis cu
  235.             Index_IP = LINE_TEXT.index('-IPAddr=')
  236.             Index_USER = LINE_TEXT.index('-User=')
  237.             IP = LINE_TEXT[Index_IP+8:Index_USER]
  238.             LOG_CMD = LINE_TEXT[Index_USER+6:].rstrip('\n')
  239.             USER = LOG_CMD.split(';')[0]
  240.             CMD = LOG_CMD[len(USER)+13:]
  241.             ##打印_红(f"{USER} {CMD}")
  242.             D_SYSLOG_SWITCH_H3C['L_CMD'].append((TIME_LOCAL, IP, USER, CMD))
  243.         elif TP2 == 'SHELL_LOGIN':           ## xxx logged in from xxx.xxx.xxx.xxx.
  244.             SP = LINE_TEXT[X+1:-1].split()
  245.             USER = SP[0]
  246.             IP = SP[4]
  247.             D_SYSLOG_SWITCH_H3C['L_LOGIN'].append(('LOGIN', TIME_LOCAL, USER, IP))
  248.         elif TP2 == 'SHELL_LOGOUT':          ## xxx logged out from xxx.xxx.xxx.xxx.
  249.             SP = LINE_TEXT[X+1:-1].split()
  250.             USER = SP[0]
  251.             IP = SP[4]
  252.             D_SYSLOG_SWITCH_H3C['L_LOGIN'].append(('LOGOUT', TIME_LOCAL, USER, IP))
  253.         else:
  254.             return((1, TP1, TP2))
  255.     elif TP1 == 'CFGMAN':
  256.         if TP2 == 'CFGMAN_CFGCHANGED':       ## -EventIndex=74-CommandSource=snmp-ConfigSource=startup-ConfigDestination=running; Configuration changed.
  257.             D_SYSLOG_SWITCH_H3C['L_CFGCHANGED'].append(TIME_LOCAL)
  258.         else:
  259.             return((1, TP1, TP2))
  260.     elif TP1 == 'ARP':
  261.         #print(f"LINE_TEXT={LINE_TEXT}")
  262.         if TP2 == 'ARP_RATE_EXCEEDED':      ## %%10ARP/4/ARP_RATE_EXCEEDED: The ARP packet rate(100 pps) exceeded the rate limit(100 pps) on interface GigabitEthernet1/0/25 in the last 60 seconds
  263.             ARP_RATE_EXCEEDED(D_SYSLOG_SWITCH_H3C, LINE_TEXT[X+1:])
  264.         else:
  265.             return((1, TP1, TP2))
  266.     else:
  267.         return((1, TP1, TP2))
  268.     return((0, TP1, TP2))
  269.  
  270. ## 解析SYSLOG日志文件
  271. def FILE_H3C(D_SYSLOG_SWITCH_H3C, FILE_PATH, TIME_STAMP_MIN, TIME_STAMP_MAX):
  272.     #print("RUN", FILE_PATH, TIME_STAMP_MIN, TIME_STAMP_MAX)
  273.     TIME_S = time.time()
  274.     TOT_N = 0
  275.     SELECT_N = 0
  276.     解析数量 = 0
  277.     for LINE_BYTES in open(FILE_PATH, mode='br'):
  278.         TOT_N += 1
  279.         try:
  280.             LINE_TEXT = LINE_BYTES.decode('UTF-8')
  281.         except Exception as e:
  282.             打印_红(f"ERROR {TOT_N} LINE_BYTES={LINE_BYTES} {e}")
  283.         else:
  284.             TIME_UTC = LINE_TEXT[:19]
  285.             TIME_STAMP = time.mktime(time.strptime(TIME_UTC, '%Y-%m-%dT%H:%M:%S'))
  286.             TIME_LOCAL = time.strftime('%Y-%m-%d %H:%M:%S', time.localtime(TIME_STAMP))
  287.             if TIME_STAMP_MIN < TIME_STAMP < TIME_STAMP_MAX:
  288.                 SELECT_N += 1
  289.                 #print(TIME_UTC, TIME_LOCAL, 'RUN')
  290.                 ST,TP1,TP2 = LINE_H3C(D_SYSLOG_SWITCH_H3C, LINE_TEXT, TIME_LOCAL)
  291.                 if ST != 0:
  292.                     #打印_红(f"{TOT_N} 未知LOG")
  293.                     #break
  294.                     if (TP1,TP2) in D_SYSLOG_SWITCH_H3C['D_LOG_OTHER']:
  295.                         D_SYSLOG_SWITCH_H3C['D_LOG_OTHER'][(TP1,TP2)] += 1
  296.                     else:
  297.                         D_SYSLOG_SWITCH_H3C['D_LOG_OTHER'][(TP1,TP2)] = 1
  298.                 else:
  299.                     解析数量 += 1
  300.             else:
  301.                 #print(TIME_UTC, TIME_LOCAL, 'PASS')
  302.                 pass
  303.     TIME_RUN = time.time() - TIME_S
  304.     return((FILE_PATH, TIME_STAMP_MIN, TIME_STAMP_MAX, TOT_N, SELECT_N, 解析数量, TIME_RUN))
  305.  
  306.  
  307.  
  308. def SYSLOG_SWITCH_H3C(FILE_PATH, SHOW=0):
  309.     D_SYSLOG_SWITCH_H3C = {}
  310.     D_SYSLOG_SWITCH_H3C['D_ACL_LOG_IPv4'] = {} # 重点ACL规则匹配记录
  311.     D_SYSLOG_SWITCH_H3C['D_ACL_LOG_IPv6'] = {} # 重点ACL规则匹配记录
  312.     D_SYSLOG_SWITCH_H3C['D_IF_PHY']  = {} # 接口物理断开记录
  313.     D_SYSLOG_SWITCH_H3C['D_IF_LINK'] = {} # 接口链路断开记录
  314.     D_SYSLOG_SWITCH_H3C['L_LLDP']    = [] # 邻接设备记录
  315.     D_SYSLOG_SWITCH_H3C['D_IF_MAC']  = {} # 接口电脑MAC记录
  316.     D_SYSLOG_SWITCH_H3C['L_CMD']     = [] # 用户执行命令记录
  317.     D_SYSLOG_SWITCH_H3C['L_LOGIN']   = [] # 登录信息
  318.     D_SYSLOG_SWITCH_H3C['L_FTP']     = []
  319.     D_SYSLOG_SWITCH_H3C['L_CFGCHANGED'] = []  # 配置被修改时间记录
  320.     D_SYSLOG_SWITCH_H3C['D_LOG_OTHER'] = {} # 未解析日志记录
  321.     D_SYSLOG_SWITCH_H3C['D_ARP_EXCEEDED'] = {} # ARP限制
  322.     D_SYSLOG_SWITCH_H3C['D_STORM_CONSTRAIN_EXCEED'] = {}   #广播风暴达到阈值次数
  323.     
  324.  
  325.     TIME_STAMP_MIN = 0
  326.     TIME_STAMP_MAX = time.time()    # 默认为当前时间戳
  327.     R = FILE_H3C(D_SYSLOG_SWITCH_H3C, FILE_PATH, TIME_STAMP_MIN, TIME_STAMP_MAX)
  328.     if SHOW == 1:
  329.         打印_黄("D_SYSLOG_SWITCH_H3C['D_ACL_LOG_IPv4'] 匹配ACL日志")
  330.         L_K = [i for i in D_SYSLOG_SWITCH_H3C['D_ACL_LOG_IPv4']]
  331.         L_K.sort()
  332.         for K in L_K:
  333.             PORT, RULE = K
  334.             SP_RULE = RULE.split()
  335.             if len(SP_RULE) > 2:
  336.                 if SP_RULE[3] == 'permit':
  337.                     打印_绿(f"{D_SYSLOG_SWITCH_H3C['D_ACL_LOG_IPv4'][K]:8}  {PORT:33s} {RULE}")
  338.                 elif SP_RULE[3] == 'deny':
  339.                     打印_红(f"{D_SYSLOG_SWITCH_H3C['D_ACL_LOG_IPv4'][K]:8}  {PORT:33s} {RULE}")
  340.                 else:
  341.                     print(f"ERR1 SP_RULE[3]={SP_RULE[3]} {K} {FILE_PATH}")
  342.             else:
  343.                 print(f"ERR2 {K} {FILE_PATH}")
  344.         
  345.         打印_黄("D_SYSLOG_SWITCH_H3C['D_ACL_LOG_IPv6'] 匹配ACL日志")
  346.         L_K = [i for i in D_SYSLOG_SWITCH_H3C['D_ACL_LOG_IPv6']]
  347.         L_K.sort()
  348.         for K in L_K:
  349.             PORT, RULE = K
  350.             SP_RULE = RULE.split()
  351.             if len(SP_RULE) > 2:
  352.                 if SP_RULE[3] == 'permit':
  353.                     打印_绿(f"{D_SYSLOG_SWITCH_H3C['D_ACL_LOG_IPv6'][K]:8}  {PORT:33s} {RULE}")
  354.                 elif SP_RULE[3] == 'deny':
  355.                     打印_红(f"{D_SYSLOG_SWITCH_H3C['D_ACL_LOG_IPv6'][K]:8}  {PORT:33s} {RULE}")
  356.                 else:
  357.                     print(f"ERR1 SP_RULE[3]={SP_RULE[3]} {K} {FILE_PATH}")
  358.             else:
  359.                 print(f"ERR2 {K} {FILE_PATH}")
  360.         
  361.         打印_黄("D_SYSLOG_SWITCH_H3C['D_ARP_EXCEEDED'] ARP 发包超过阈值")
  362.         L_K = [i for i in D_SYSLOG_SWITCH_H3C['D_ARP_EXCEEDED']]
  363.         L_K.sort()
  364.         for K in L_K:
  365.             合计 = D_SYSLOG_SWITCH_H3C['D_ARP_EXCEEDED'][K]
  366.             接口,限制值 = K
  367.             打印_青(f"{合计:8}  {接口:22s}({限制值})")
  368.         
  369.         打印_黄("D_SYSLOG_SWITCH_H3C['D_STORM_CONSTRAIN_EXCEED'] 广播风暴发包超过阈值")
  370.         L = [(D_SYSLOG_SWITCH_H3C['D_STORM_CONSTRAIN_EXCEED'][i],i) for i in D_SYSLOG_SWITCH_H3C['D_STORM_CONSTRAIN_EXCEED']]
  371.         L.sort()
  372.         for 次数,接口 in L:
  373.             打印_红(f"{次数:8}  {接口:22s}")
  374.         
  375.         打印_黄("D_SYSLOG_SWITCH_H3C['L_LLDP'] 邻居设备变化")
  376.         for TIME_LOCAL, ST, IF_ID, IF_MAC in D_SYSLOG_SWITCH_H3C['L_LLDP']:
  377.             if ST == 'CREATE':
  378.                 打印_绿(f"    {TIME_LOCAL} {IF_ID} {IF_MAC} {ST}")
  379.             else:
  380.                 打印_红(f"    {TIME_LOCAL} {IF_ID} {IF_MAC} {ST}")
  381.         
  382.         打印_黄("D_SYSLOG_SWITCH_H3C['D_IF_PHY'] 端口物理线路变化")
  383.         for K in D_SYSLOG_SWITCH_H3C['D_IF_PHY']:
  384.             打印_红(f"    {K:21s} DOWN/UP 次数 {len(D_SYSLOG_SWITCH_H3C['D_IF_PHY'][K])}")
  385.         
  386.         #打印_黄('D_SYSLOG_SWITCH_H3C['D_IF_LINK']')
  387.         #for K in D_SYSLOG_SWITCH_H3C['D_IF_LINK']:
  388.         #    print(f"    {K:21s} DOWN/UP 次数 {len(D_SYSLOG_SWITCH_H3C['D_IF_LINK'][K])}")
  389.         
  390.         打印_黄("D_SYSLOG_SWITCH_H3C['L_CMD']")
  391.         for TIME_LOCAL, IP, USER, CMD in D_SYSLOG_SWITCH_H3C['L_CMD']:
  392.             打印_青(f"    {TIME_LOCAL} {IP:15s} {USER:8s} '{CMD}'")
  393.         
  394.         打印_黄("D_SYSLOG_SWITCH_H3C['L_LOGIN'] 登录登出详细")
  395.         for ST, TIME_LOCAL, USER, IP in D_SYSLOG_SWITCH_H3C['L_LOGIN']:
  396.             if ST == 'LOGIN':
  397.                 打印_青(f"    {TIME_LOCAL} {IP:15s} {ST:6s} {USER}")
  398.             elif ST == 'LOGOUT':
  399.                 打印_蓝(f"    {TIME_LOCAL} {IP:15s} {ST:6s} {USER}")
  400.             else:
  401.                 打印_红(f"    {TIME_LOCAL} {IP:15s} {ST:6s} {USER}")
  402.         
  403.         打印_黄("D_LOGIN 登录汇总")
  404.         D_LOGIN = {}
  405.         for ST, TIME_LOCAL, USER, IP in D_SYSLOG_SWITCH_H3C['L_LOGIN']:
  406.             if ST == 'LOGIN':
  407.                 if (IP, USER) not in D_LOGIN:
  408.                     D_LOGIN[(IP, USER)] = []
  409.                 D_LOGIN[(IP, USER)].append(TIME_LOCAL)
  410.         for K in D_LOGIN:
  411.             打印_红(f"    {K} {D_LOGIN[K]}")
  412.         
  413.         打印_黄("D_SYSLOG_SWITCH_H3C['L_CFGCHANGED'] 配置被修改时间记录")
  414.         for i in D_SYSLOG_SWITCH_H3C['L_CFGCHANGED']:
  415.             打印_紫(f"    {i}")
  416.         
  417.         打印_黄("D_SYSLOG_SWITCH_H3C['L_FTP']")
  418.         for TIME_LOCAL, LOG_TEXT in D_SYSLOG_SWITCH_H3C['L_FTP']:
  419.             打印_青(f"    {TIME_LOCAL} {LOG_TEXT}")
  420.         
  421.         打印_黄("D_SYSLOG_SWITCH_H3C['D_LOG_OTHER'] 未解析日志记录")
  422.         L_K = [i for i in D_SYSLOG_SWITCH_H3C['D_LOG_OTHER']]
  423.         L_K.sort()
  424.         for K in L_K:
  425.             print(f"{D_SYSLOG_SWITCH_H3C['D_LOG_OTHER'][K]:5} {K}")
  426.         
  427.         FILE_PATH, TIME_STAMP_MIN, TIME_STAMP_MAX, TOT_N, SELECT_N, 解析数量, TIME_RUN = R
  428.         时间文本格式 = '%Y-%m-%d %H:%M:%S'
  429.         打印_红(f"日志路径 : {FILE_PATH}")
  430.         打印_青(f"开始/结束: {时间戳_2_时间文本(TIME_STAMP_MIN, 时间文本格式)} / {时间戳_2_时间文本(TIME_STAMP_MAX, 时间文本格式)}")
  431.         打印_绿(f"解析/筛选/总数: {解析数量}/{SELECT_N}/{TOT_N} {(解析数量/TOT_N)*100:.2f}(%)/{(SELECT_N/TOT_N)*100:.2f}(%)/100(%)  用时: {TIME_RUN:.2f}秒")
  432.     
  433.     ## 返回需要的信息
  434.     D_RETURN = {'PERMIT':{}, 'DENY':{}, 'OTHER':{}}
  435.     #print(D_SYSLOG_SWITCH_H3C['D_ACL_LOG_IPv4'])
  436.     for K in D_SYSLOG_SWITCH_H3C['D_ACL_LOG_IPv4']:
  437.         PORT, RULE = K
  438.         SP_RULE = RULE.split()
  439.         KEY_NEW = f"{PORT} {SP_RULE[0]}"
  440.         if len(SP_RULE) > 2:
  441.             if SP_RULE[3] == 'permit':
  442.                 if KEY_NEW not in D_RETURN['PERMIT']:
  443.                     D_RETURN['PERMIT'][KEY_NEW] = 0
  444.                 D_RETURN['PERMIT'][KEY_NEW] += D_SYSLOG_SWITCH_H3C['D_ACL_LOG_IPv4'][K]
  445.             elif SP_RULE[3] == 'deny':
  446.                 if KEY_NEW not in D_RETURN['DENY']:
  447.                     D_RETURN['DENY'][KEY_NEW] = 0
  448.                 D_RETURN['DENY'][KEY_NEW] += D_SYSLOG_SWITCH_H3C['D_ACL_LOG_IPv4'][K]
  449.             else:
  450.                 print(f"ERR1 SP_RULE[3]={SP_RULE[3]} {K} {FILE_PATH}")
  451.         else:
  452.             print(f"ERR2 {K} {FILE_PATH}")
  453.     return(D_RETURN)
  454.  
  455. if __name__ == '__main__':
  456.     FILE_PATH = '华三交换机日志文件路径'
  457.     SHOW = 1    # 查看重要日志信息
  458.     D_ACL_INFO = SYSLOG_SWITCH_H3C(FILE_PATH, SHOW)
  459.     print(D_ACL_INFO)

DEF_SYSLOG_USG.py

华为USG防火墙

  1. # -*- coding: utf8 -*-
  2. import time
  3. from DEF_COLOR import *   ## 终端显示颜色
  4.  
  5. def 时间戳_2_时间文本(时间戳, 时间文本格式='%Y-%m-%d %H:%M:%S'):
  6.     #时间文本格式 = '%Y-%m-%d %H:%M:%S'
  7.     时间类 = time.localtime(时间戳)
  8.     时间文本 = time.strftime(时间文本格式, 时间类)
  9.     return(时间文本)
  10.  
  11. def USG_LOG_TYPE(LINE_TEXT):
  12.     A = LINE_TEXT.find('%')     ## 2022-12-11T16:03:31+08:00 IPS6515E %%01SECIF/6/STREAM(l)[136014]: In Last Five Minutes
  13.     if A != -1:
  14.         #打印_黄(LINE_TEXT[A:])
  15.         B = LINE_TEXT.find('(', A)
  16.         if B != -1:
  17.             #打印_绿(LINE_TEXT[B:])
  18.             C = LINE_TEXT.find(':', B)  # 找日志正文开始位置标志
  19.             if C != -1:
  20.                 #打印_蓝(LINE_TEXT[C:])
  21.                 #打印_青(LINE_TEXT[A+4:B])
  22.                 SP = LINE_TEXT[A+4:B].split('/')
  23.                 return((SP[0], SP[2], C+1))
  24.             else:
  25.                 打印_红(f"找位置标志':'失败(日志正文开始位) {LINE_TEXT}")
  26.                 return((':-1', LINE_TEXT[A:B], -1))
  27.         else:
  28.             打印_红(f"找位置标志'('失败 {LINE_TEXT}")
  29.             return((LINE_TEXT[:A], '(-1', -1))
  30.     else:
  31.         #打印_红(f"找位置标志'%'失败 {LINE_TEXT}")
  32.         A2 = LINE_TEXT.find('DS/4/DATASYNC_CFGCHANGE')
  33.         if A2 != -1:
  34.             return(('DS', 'DATASYNC_CFGCHANGE', A2+1))
  35.         else:
  36.             打印_红(f"找位置标志'%'失败 {LINE_TEXT}")
  37.             return(('%-1', LINE_TEXT, -1))
  38.  
  39. ## 解析SYSLOG日志一行内容
  40. # POLICY 规则匹配日志 规则内配置 policy logging 产生
  41. # SECLOG/4/PACKET_DENY 丢包信息 规则内配置 session logging 产生
  42. def USG_LOG_LINE(D_LOG_USG, LINE_TEXT, TIME_LOCAL):
  43.     TP1, TP2, X = USG_LOG_TYPE(LINE_TEXT)
  44.     if TP1 == 'POLICY':
  45.         if TP2 in ('POLICYDENY', 'POLICYPERMIT'):
  46.             #print(TP1, TP2, LINE_TEXT[X:-1])
  47.             SP = LINE_TEXT[X:-1].split(',')
  48.             PT = SP[1].split('=')[-1]
  49.             SIP = SP[2].split('=')[-1]
  50.             SPORT = SP[3].split('=')[-1]
  51.             DIP   = SP[4].split('=')[-1]
  52.             DPORT = SP[5].split('=')[-1]
  53.             TIME  = SP[6].split('=')[-1]
  54.             SZONE = SP[7].split('=')[-1]
  55.             DZONE = SP[8].split('=')[-1]
  56.             RULE_NAME = SP[9].split('=')[-1][:-1]
  57.             if PT == '6':
  58.                 PT = 'TCP'
  59.             elif PT == '17':
  60.                 PT = 'UDP'
  61.             D_LOG_USG['L_SEC_RULE'].append((TIME, PT, SIP, SPORT, DIP, DPORT, SZONE, DZONE, RULE_NAME, TP2[6:]))
  62.         else:
  63.             return((TP1, TP2))
  64.     elif TP1 == 'SECLOG':
  65.         if TP2 == 'PACKET_DENY':    # IPVer=4,Protocol=tcp,SourceIP=89.248.164.165,DestinationIP=183.129.153.43,SourcePort=48397,DestinationPort=8888,DestinationNatIP=192.168.200.112,DestinationNatPort=8888,BeginTime=1671059311,EndTime=1671059311,SourceVpnID=0,DestinationVpnID=0,SourceZone=untrust,DestinationZone=trust,PolicyName=HW,CloseReason=policy-deny.
  66.             #print(TP1, TP2, LINE_TEXT[X:-1])
  67.             SP = LINE_TEXT[X:-1].split(',')
  68.             IPVer = SP[0].split('=')[-1]
  69.             Protocol = SP[1].split('=')[-1]
  70.             SIP = SP[2].split('=')[-1]
  71.             DIP   = SP[3].split('=')[-1]
  72.             SPORT = SP[4].split('=')[-1]
  73.             DPORT = SP[5].split('=')[-1]
  74.             D_NAT_IP = SP[6].split('=')[-1]
  75.             D_NAT_PORT = SP[7].split('=')[-1]
  76.             BeginTime = int(SP[8].split('=')[-1])
  77.             EndTime = int(SP[9].split('=')[-1])
  78.             SZONE = SP[12].split('=')[-1]
  79.             DZONE = SP[13].split('=')[-1]
  80.             PolicyName = SP[14].split('=')[-1]
  81.             CloseReason = SP[15].split('=')[-1][:-1]
  82.             if CloseReason == 'policy-deny':
  83.                 丢包类型 = '安全策略丢包'
  84.             elif CloseReason == 'default-policy-deny':
  85.                 丢包类型 = '缺省包过滤丢包'
  86.             elif CloseReason == 'session miss':
  87.                 丢包类型 = '未命中会话丢包'
  88.             elif CloseReason == 'others':
  89.                 丢包类型 = '其他类型丢包'
  90.             else:
  91.                 丢包类型 = f'未知类型丢包:{CloseReason}'
  92.             D_LOG_USG['L_SEC_PACKET'].append((TIME_LOCAL, IPVer, Protocol, SIP, DIP, SPORT, DPORT, D_NAT_IP, D_NAT_PORT, BeginTime, EndTime, SZONE, DZONE, PolicyName, 丢包类型))
  93.         elif TP2 == 'SESSION_TEARDOWN':
  94.             SP = LINE_TEXT[X:-1].split(',')
  95.             IPVer = SP[0].split('=')[-1]
  96.             Protocol = SP[1].split('=')[-1]
  97.             SIP = SP[2].split('=')[-1]
  98.             DIP   = SP[3].split('=')[-1]
  99.             SPORT = SP[4].split('=')[-1]
  100.             DPORT = SP[5].split('=')[-1]
  101.             D_NAT_IP = SP[6].split('=')[-1]
  102.             D_NAT_PORT = SP[7].split('=')[-1]
  103.             BeginTime = int(SP[8].split('=')[-1])
  104.             EndTime = int(SP[9].split('=')[-1])
  105.             SendPkts =  int(SP[10].split('=')[-1])
  106.             SendBytes = int(SP[11].split('=')[-1])
  107.             RcvPkts =   int(SP[12].split('=')[-1])
  108.             RcvBytes =  int(SP[13].split('=')[-1])
  109.             SZONE = SP[16].split('=')[-1]
  110.             DZONE = SP[17].split('=')[-1]
  111.             PolicyName = SP[18].split('=')[-1]
  112.             CloseReason = SP[19].split('=')[-1][:-1]
  113.             D_LOG_USG['L_SEC_SESSION'].append((TIME_LOCAL, IPVer, Protocol, SIP, DIP, SPORT, DPORT, D_NAT_IP, D_NAT_PORT, BeginTime, EndTime, SZONE, DZONE, PolicyName, CloseReason))
  114.         else:
  115.             return((TP1, TP2))
  116.     elif TP1 == 'SHELL':
  117.         if TP2 in ('LOGIN', 'LOGOUT'):
  118.             #SP = LINE_TEXT[X:-1].split(',')
  119.             #print(SP)
  120.             #用户类型 = SP[1].split('=')[-1]
  121.             #用户名 = SP[2].split('=')[-1]
  122.             #用户地址 = SP[4].split('=')[-1]
  123.             #D_LOG_USG['L_LOGIN'].append((TIME_LOCAL, TP2, 用户类型, 用户名, 用户地址))
  124.             D_LOG_USG['L_LOGIN'].append((TIME_LOCAL, TP1, TP2, LINE_TEXT[X:-1]))
  125.         else:
  126.             return((TP1, TP2))
  127.     elif TP1 == 'PHY':
  128.         if TP2 in ('STATUSDOWN', 'STATUSUP'):
  129.             接口号 = LINE_TEXT[X:-1].split(':')[0]
  130.             IF_ST = TP2[6:]
  131.             if 接口号 in D_LOG_USG['D_IF_PHY']:
  132.                 D_LOG_USG['D_IF_PHY'][接口号].append((TIME_LOCAL, IF_ST))
  133.             else:
  134.                 D_LOG_USG['D_IF_PHY'][接口号] = [(TIME_LOCAL, IF_ST)]
  135.         else:
  136.             return((TP1, TP2))
  137.     else:
  138.         if TP1 == '':
  139.             打印_紫(LINE_TEXT[X:-1])
  140.         return((TP1, TP2))
  141.     return(0)
  142.  
  143. ## 解析SYSLOG日志文件
  144. def USG_LOG_FILE(D_LOG_USG, FILE_PATH, TIME_STAMP_MIN, TIME_STAMP_MAX):
  145.     #print("RUN", FILE_PATH, TIME_STAMP_MIN, TIME_STAMP_MAX)
  146.     TIME_S = time.time()
  147.     TOT_N = 0
  148.     SELECT_N = 0
  149.     for LINE_BYTES in open(FILE_PATH, mode='br'):
  150.         TOT_N += 1
  151.         try:
  152.             LINE_TEXT = LINE_BYTES.decode('GB2312')
  153.         except Exception as e:
  154.             打印_红(f"ERROR {TOT_N} LINE_BYTES={LINE_BYTES} {e}")
  155.         else:
  156.             TIME_UTC = LINE_TEXT[:19]
  157.             TIME_STAMP = time.mktime(time.strptime(TIME_UTC, '%Y-%m-%dT%H:%M:%S'))
  158.             #TIME_STAMP = 日志时间转时间戳(TIME_UTC, 8)
  159.             TIME_LOCAL = time.strftime('%Y-%m-%d %H:%M:%S', time.localtime(TIME_STAMP))
  160.             if TIME_STAMP_MIN < TIME_STAMP < TIME_STAMP_MAX:
  161.                 SELECT_N += 1
  162.                 #print(TIME_UTC, TIME_LOCAL, 'RUN')
  163.                 R = USG_LOG_LINE(D_LOG_USG, LINE_TEXT, TIME_LOCAL)
  164.                 if R != 0:
  165.                     #打印_红(f"{TOT_N} 未知LOG")
  166.                     #break
  167.                     if R in D_LOG_USG['D_LOG_OTHER']:
  168.                         D_LOG_USG['D_LOG_OTHER'][R] += 1
  169.                     else:
  170.                         D_LOG_USG['D_LOG_OTHER'][R] = 1
  171.             else:
  172.                 #print(TIME_UTC, TIME_LOCAL, 'PASS')
  173.                 pass
  174.     TIME_RUN = time.time() - TIME_S
  175.     #打印_绿(f"{FILE_PATH} 完成 处理日志数量 {SELECT_N}/{TOT_N} 筛选数/总日志数 用时={TIME_RUN:.2f}秒")
  176.     return((FILE_PATH, TIME_STAMP_MIN, TIME_STAMP_MAX, TOT_N, SELECT_N, TIME_RUN))
  177.  
  178.  
  179. def 秒数转时长表示(总秒数):
  180.     天数 = 总秒数//86400
  181.     剩余秒数 = 总秒数%86400
  182.     
  183.     时数 = 剩余秒数//3600
  184.     剩余秒数 = 剩余秒数%3600
  185.     
  186.     分数 = 剩余秒数//60
  187.     剩余秒数 = 剩余秒数%60
  188.     
  189.     #print(f"{天数}:{时数}:{分数}:{剩余秒数}(天:时:分:秒)")
  190.     return(f"{天数:02}:{时数:02}:{分数:02}:{剩余秒数:02}")
  191.  
  192.  
  193. def USG(PATH_SYSLOG_FILE, SHOW=0):
  194.     D_LOG_USG = {}
  195.     D_LOG_USG['L_SEC_RULE'] = []
  196.     D_LOG_USG['L_SEC_PACKET'] = []
  197.     D_LOG_USG['L_SEC_SESSION'] = []
  198.     D_LOG_USG['D_IF_PHY']  = {} # 接口物理断开记录
  199.     D_LOG_USG['D_IF_LINK'] = {} # 接口链路断开记录
  200.     D_LOG_USG['L_CMD'] = []     # 用户执行命令记录
  201.     D_LOG_USG['L_LOGIN'] = []   # 登录信息
  202.     D_LOG_USG['D_LOG_OTHER'] = {} # 未解析日志记录
  203.     
  204.     
  205.     TIME_STAMP_MIN = 0
  206.     TIME_STAMP_MAX = time.time()    # 默认为当前时间戳
  207.     R = USG_LOG_FILE(D_LOG_USG, PATH_SYSLOG_FILE, TIME_STAMP_MIN, TIME_STAMP_MAX)
  208.     if SHOW == 1:
  209.         打印_黄("L_SEC_RULE")
  210.         D_SEC_RULE = {}
  211.         for TIME, PT, SIP, SPORT, DIP, DPORT, SZONE, DZONE, RULE_NAME, DoP in D_LOG_USG['L_SEC_RULE']:
  212.             if DoP == 'DENY':
  213.                 打印_红(f"    {TIME}  {RULE_NAME:8s} {DoP:6s} {PT:4s} {SIP:15s} {SPORT:5s} -> {DIP:15s} {DPORT:5s} {SZONE} -> {DZONE}")
  214.             #else:
  215.             #    打印_绿(f"    {TIME}  {RULE_NAME:8s} {DoP:6s} {PT:4s} {SIP:15s} {SPORT:5s} -> {DIP:15s} {DPORT:5s} {SZONE} -> {DZONE}")
  216.             KEY = (RULE_NAME, DoP)
  217.             if KEY in D_SEC_RULE:
  218.                 D_SEC_RULE[KEY] += 1
  219.             else:
  220.                 D_SEC_RULE[KEY] = 1
  221.         for KEY in D_SEC_RULE:
  222.             if KEY[1] == 'DENY':
  223.                 打印_红(f"    {KEY[0]:8s} {KEY[1]:6s} {D_SEC_RULE[KEY]}")
  224.             else:
  225.                 打印_绿(f"    {KEY[0]:8s} {KEY[1]:6s} {D_SEC_RULE[KEY]}")
  226.         
  227.         打印_黄("L_SEC_SESSION")
  228.         for TIME_LOCAL, IPVer, Protocol, SIP, DIP, SPORT, DPORT, D_NAT_IP, D_NAT_PORT, BeginTime, EndTime, SZONE, DZONE, PolicyName, CloseReason in D_LOG_USG['L_SEC_SESSION']:
  229.             会话秒数 = EndTime-BeginTime
  230.             if 会话秒数 < 30:
  231.                 打印_灰(f"    {TIME}  {PolicyName:8s} {Protocol:4s} {SIP:15s} {SPORT:5s} -> 用时:{秒数转时长表示(会话秒数)}(天:时:分:秒) {会话秒数}秒")
  232.             else:
  233.                 打印_紫(f"    {TIME}  {PolicyName:8s} {Protocol:4s} {SIP:15s} {SPORT:5s} -> 用时:{秒数转时长表示(会话秒数)}(天:时:分:秒) {会话秒数}秒")
  234.         
  235.         打印_黄("L_SEC_PACKET")
  236.         D_SEC_PACKET = {}
  237.         for TIME_LOCAL, IPVer, Protocol, SIP, DIP, SPORT, DPORT, D_NAT_IP, D_NAT_PORT, BeginTime, EndTime, SZONE, DZONE, PolicyName, 丢包类型 in D_LOG_USG['L_SEC_PACKET']:
  238.             #打印_红(f"    {TIME_LOCAL} [{时间戳_2_时间文本(BeginTime)} {时间戳_2_时间文本(EndTime)}] {丢包类型} {PolicyName:8s} {Protocol}.{IPVer} {SIP:15s} {SPORT:5s} -> {DIP:15s} {DPORT:5s} -> {D_NAT_IP}:{D_NAT_PORT} {SZONE} -> {DZONE}")
  239.             KEY = (PolicyName, 丢包类型)
  240.             if KEY in D_SEC_PACKET:
  241.                 D_SEC_PACKET[KEY] += 1
  242.             else:
  243.                 D_SEC_PACKET[KEY] = 1
  244.         for KEY in D_SEC_PACKET:
  245.             打印_红(f"    {KEY[0]:8s} {KEY[1]} {D_SEC_PACKET[KEY]}")
  246.             
  247.         打印_黄("D_IF_PHY")
  248.         for K in D_LOG_USG['D_IF_PHY']:
  249.             print(f"    {K:21s} DOWN/UP 次数 {len(D_LOG_USG['D_IF_PHY'][K])}")
  250.             for TIME_LOCAL, IF_ST in D_LOG_USG['D_IF_PHY'][K]:
  251.                 if IF_ST == 'DOWN':
  252.                     打印_红(f"        {TIME_LOCAL} DOWN")
  253.                 else:
  254.                     打印_绿(f"        {TIME_LOCAL} {IF_ST}")
  255.         
  256.         #print("D_IF_LINK")
  257.         #for K in D_LOG_USG['D_IF_LINK']:
  258.         #    print(f"    {K:21s} DOWN/UP 次数 {len(D_LOG_USG['D_IF_LINK'][K])}")
  259.         
  260.         打印_黄("L_LOGIN")
  261.         for i in D_LOG_USG['L_LOGIN']:
  262.             打印_红(f"    {' '.join(i)}")
  263.         
  264.         打印_黄("D_LOG_OTHER")
  265.         L_K = [i for i in D_LOG_USG['D_LOG_OTHER']]
  266.         L_K.sort()
  267.         for K in L_K:
  268.             print(f"{D_LOG_USG['D_LOG_OTHER'][K]:5} {K}")
  269.         
  270.         FILE_PATH, TIME_STAMP_MIN, TIME_STAMP_MAX, TOT_N, SELECT_N, TIME_RUN = R
  271.         时间文本格式 = '%Y-%m-%d %H:%M:%S'
  272.         打印_紫(f"日志路径 : {FILE_PATH}")
  273.         打印_青(f"开始/结束: {时间戳_2_时间文本(TIME_STAMP_MIN, 时间文本格式)} / {时间戳_2_时间文本(TIME_STAMP_MAX, 时间文本格式)}")
  274.         打印_绿(f"解析/总数: {SELECT_N}/{TOT_N} {(SELECT_N/TOT_N)*100:.2f}(%)  用时: {TIME_RUN:.2f}秒")
  275.     
  276.     ## 返回需要的信息(防火墙规则放行和阻止的统计)
  277.     D_RETURN = {'PERMIT':{}, 'DENY':{}, 'OTHER':{}}
  278.     for TIME, PT, SIP, SPORT, DIP, DPORT, SZONE, DZONE, RULE_NAME, DoP in D_LOG_USG['L_SEC_RULE']:
  279.         if DoP == 'PERMIT':
  280.             if RULE_NAME not in D_RETURN['PERMIT']:
  281.                 D_RETURN['PERMIT'][RULE_NAME] = 0
  282.             D_RETURN['PERMIT'][RULE_NAME] += 1
  283.         elif DoP == 'DENY':
  284.             if RULE_NAME not in D_RETURN['DENY']:
  285.                 D_RETURN['DENY'][RULE_NAME] = 0
  286.             D_RETURN['DENY'][RULE_NAME] += 1
  287.         else:
  288.             if RULE_NAME not in D_RETURN['OTHER']:
  289.                 D_RETURN['OTHER'][RULE_NAME] = 0
  290.             D_RETURN['OTHER'][RULE_NAME] += 1
  291.     return(D_RETURN)
  292.  
  293.  
  294. if __name__ == '__main__':
  295.     FILE_PATH = '华为防火墙日志文件路径'
  296.     SHOW = 1    # 查看重要日志信息
  297.     D_RULE_INFO = USG(PATH_SYSLOG_FILE, SHOW)
  298.     print(D_RULE_INFO)

DEF_COLOR.py

给点颜色看看

  1. # -*- coding: utf8 -*-
  2. import os
  3.  
  4. ## 终端显示颜色
  5. if os.name == 'nt':       # Windows
  6.     import ctypes,sys
  7.     STD_OUTPUT_HANDLE = -11
  8.     
  9.     # Windows CMD命令行 字体颜色定义 text colors
  10.     黑字 = 0x00 # black.
  11.     暗蓝字 = 0x01 # dark blue.
  12.     暗绿字 = 0x02 # dark green.
  13.     暗青字 = 0x03 # dark skyblue.
  14.     暗红字 = 0x04 # dark red.
  15.     暗紫字 = 0x05 # dark pink.
  16.     暗黄字 = 0x06 # dark yellow.
  17.     暗白字 = 0x07 # dark white.
  18.     灰字 = 0x08 # dark gray.
  19.     蓝字 = 0x09 # blue.
  20.     绿字 = 0x0a # green.
  21.     青字 = 0x0b # skyblue.
  22.     红字 = 0x0c # red.
  23.     紫字 = 0x0d # pink.
  24.     黄字 = 0x0e # yellow.
  25.     白字 = 0x0f # white.
  26.     
  27.     # Windows CMD命令行 背景颜色定义 background colors
  28.     暗蓝底 = 0x10 # dark blue.
  29.     暗绿底 = 0x20 # dark green.
  30.     暗青底 = 0x30 # dark skyblue.
  31.     暗红底 = 0x40 # dark red.
  32.     暗紫底 = 0x50 # dark pink.
  33.     暗黄底 = 0x60 # dark yellow.
  34.     暗白底 = 0x70 # dark white.
  35.     灰底 = 0x80 # dark gray.
  36.     蓝底 = 0x90 # blue.
  37.     绿底 = 0xa0 # green.
  38.     青底 = 0xb0 # skyblue.
  39.     红底 = 0xc0 # red.
  40.     紫底 = 0xd0 # pink.
  41.     黄底 = 0xe0 # yellow.
  42.     白底 = 0xf0 # white.
  43.     
  44.     std_out_handle = ctypes.windll.kernel32.GetStdHandle(STD_OUTPUT_HANDLE)
  45.     
  46.     def set_cmd_text_color(color, handle=std_out_handle):
  47.         Bool = ctypes.windll.kernel32.SetConsoleTextAttribute(handle, color)
  48.         return Bool
  49.     
  50.     def resetColor():
  51.         set_cmd_text_color(红字 | 绿字 | 蓝字)
  52.     
  53.     def 打印_黑(TEXT, SHOW=1):
  54.         if SHOW == 1:
  55.             set_cmd_text_color(黑字)
  56.             sys.stdout.write(f"{TEXT}\n")
  57.             resetColor()
  58.     def 打印_灰(TEXT, SHOW=1):
  59.         if SHOW == 1:
  60.             set_cmd_text_color(灰字)
  61.             sys.stdout.write(f"{TEXT}\n")
  62.             resetColor()
  63.     def 打印_蓝(TEXT, SHOW=1):
  64.         if SHOW == 1:
  65.             set_cmd_text_color(蓝字)
  66.             sys.stdout.write(f"{TEXT}\n")
  67.             resetColor()
  68.     def 打印_绿(TEXT, SHOW=1):
  69.         if SHOW == 1:
  70.             set_cmd_text_color(绿字)
  71.             sys.stdout.write(f"{TEXT}\n")
  72.             resetColor()
  73.     def 打印_青(TEXT, SHOW=1):
  74.         if SHOW == 1:
  75.             set_cmd_text_color(青字)
  76.             sys.stdout.write(f"{TEXT}\n")
  77.             resetColor()
  78.     def 打印_红(TEXT, SHOW=1):
  79.         if SHOW == 1:
  80.             set_cmd_text_color(红字)
  81.             sys.stdout.write(f"{TEXT}\n")
  82.             resetColor()
  83.     def 打印_紫(TEXT, SHOW=1):
  84.         if SHOW == 1:
  85.             set_cmd_text_color(紫字)
  86.             sys.stdout.write(f"{TEXT}\n")
  87.             resetColor()
  88.     def 打印_黄(TEXT, SHOW=1):
  89.         if SHOW == 1:
  90.             set_cmd_text_color(黄字)
  91.             sys.stdout.write(f"{TEXT}\n")
  92.             resetColor()
  93.     def 打印_白(TEXT, SHOW=1):
  94.         if SHOW == 1:
  95.             set_cmd_text_color(白字)
  96.             sys.stdout.write(f"{TEXT}\n")
  97.             resetColor()
  98.  
  99.     def 打印_暗蓝(TEXT, SHOW=1):
  100.         if SHOW == 1:
  101.             set_cmd_text_color(暗蓝字)
  102.             sys.stdout.write(f"{TEXT}\n")
  103.             resetColor()
  104.     def 打印_暗绿(TEXT, SHOW=1):
  105.         if SHOW == 1:
  106.             set_cmd_text_color(暗绿字)
  107.             sys.stdout.write(f"{TEXT}\n")
  108.             resetColor()
  109.     def 打印_暗青(TEXT, SHOW=1):
  110.         if SHOW == 1:
  111.             set_cmd_text_color(暗青字)
  112.             sys.stdout.write(f"{TEXT}\n")
  113.             resetColor()
  114.     def 打印_暗红(TEXT, SHOW=1):
  115.         if SHOW == 1:
  116.             set_cmd_text_color(暗红字)
  117.             sys.stdout.write(f"{TEXT}\n")
  118.             resetColor()
  119.     def 打印_暗紫(TEXT, SHOW=1):
  120.         if SHOW == 1:
  121.             set_cmd_text_color(暗紫字)
  122.             sys.stdout.write(f"{TEXT}\n")
  123.             resetColor()
  124.     def 打印_暗黄(TEXT, SHOW=1):
  125.         if SHOW == 1:
  126.             set_cmd_text_color(暗黄字)
  127.             sys.stdout.write(f"{TEXT}\n")
  128.             resetColor()
  129.     def 打印_暗白(TEXT, SHOW=1):
  130.         if SHOW == 1:
  131.             set_cmd_text_color(暗白字)
  132.             sys.stdout.write(f"{TEXT}\n")
  133.             resetColor()
  134.  
  135.     def 打印_白底黑字(TEXT, SHOW=1):
  136.         if SHOW == 1:
  137.             set_cmd_text_color(黑字 | 白底)
  138.             sys.stdout.write(f"{TEXT}\n")
  139.             resetColor()
  140.     def 打印_白底灰字(TEXT, SHOW=1):
  141.         if SHOW == 1:
  142.             set_cmd_text_color(灰字 | 白底)
  143.             sys.stdout.write(f"{TEXT}\n")
  144.             resetColor()
  145.     def 打印_白底红字(TEXT, SHOW=1):
  146.         if SHOW == 1:
  147.             set_cmd_text_color(红字 | 白底)
  148.             sys.stdout.write(f"{TEXT}\n")
  149.             resetColor()
  150.     def 打印_白底绿字(TEXT, SHOW=1):
  151.         if SHOW == 1:
  152.             set_cmd_text_color(绿字 | 白底)
  153.             sys.stdout.write(f"{TEXT}\n")
  154.             resetColor()
  155.     def 打印_白底黄字(TEXT, SHOW=1):
  156.         if SHOW == 1:
  157.             set_cmd_text_color(黄字 | 白底)
  158.             sys.stdout.write(f"{TEXT}\n")
  159.             resetColor()
  160.     def 打印_白底蓝字(TEXT, SHOW=1):
  161.         if SHOW == 1:
  162.             set_cmd_text_color(蓝字 | 白底)
  163.             sys.stdout.write(f"{TEXT}\n")
  164.             resetColor()
  165.     def 打印_白底紫字(TEXT, SHOW=1):
  166.         if SHOW == 1:
  167.             set_cmd_text_color(紫字 | 白底)
  168.             sys.stdout.write(f"{TEXT}\n")
  169.             resetColor()
  170.     def 打印_白底青字(TEXT, SHOW=1):
  171.         if SHOW == 1:
  172.             set_cmd_text_color(青字 | 白底)
  173.             sys.stdout.write(f"{TEXT}\n")
  174.             resetColor()
  175.     
  176.     def 打印_灰底红字(TEXT, SHOW=1):
  177.         if SHOW == 1:
  178.             set_cmd_text_color(红字 | 灰底)
  179.             sys.stdout.write(f"{TEXT}\n")
  180.             resetColor()
  181.     def 打印_灰底蓝字(TEXT, SHOW=1):
  182.         if SHOW == 1:
  183.             set_cmd_text_color(蓝字 | 灰底)
  184.             sys.stdout.write(f"{TEXT}\n")
  185.             resetColor()
  186.     def 打印_灰底绿字(TEXT, SHOW=1):
  187.         if SHOW == 1:
  188.             set_cmd_text_color(绿字 | 灰底)
  189.             sys.stdout.write(f"{TEXT}\n")
  190.             resetColor()
  191.             
  192.     def 打印_蓝底黄字(TEXT, SHOW=1):
  193.         if SHOW == 1:
  194.             set_cmd_text_color(黄字 | 蓝底)
  195.             sys.stdout.write(f"{TEXT}\n")
  196.             resetColor()
  197.     def 打印_蓝底白字(TEXT, SHOW=1):
  198.         if SHOW == 1:
  199.             set_cmd_text_color(白字 | 蓝底)
  200.             sys.stdout.write(f"{TEXT}\n")
  201.             resetColor()
  202.     def 打印_灰底青字(TEXT, SHOW=1):
  203.         if SHOW == 1:
  204.             set_cmd_text_color(青字 | 灰底)
  205.             sys.stdout.write(f"{TEXT}\n")
  206.             resetColor()
  207. elif os.name == 'posix':  # Linux
  208.     '''
  209.     格式： print('\033[显示方式；前景颜色；背景颜色m ..........\033[0m')
  210.     print('\033[31;42m 123\033[0m')
  211.     
  212.     显示方式
  213.         0 默认
  214.         1 高亮显示
  215.         4 下划线
  216.         5 闪烁
  217.         7 反白显示
  218.         8 不可见
  219.     
  220.     颜色 前景色 背景色
  221.     黑色     30     40
  222.     红色     31     41
  223.     绿色     32     42
  224.     黄色     33     43
  225.     蓝色     34     44
  226.     紫色     35     45
  227.     青色     36     46
  228.     白色     37     47
  229.     '''
  230.     
  231.     def 打印_灰(TEXT, SHOW=1):
  232.         if SHOW == 1:
  233.             print(f"\033[0;30;1m{TEXT}\033[0m")
  234.     def 打印_红(TEXT, SHOW=1):
  235.         if SHOW == 1:
  236.             print(f"\033[0;31;1m{TEXT}\033[0m")
  237.     def 打印_绿(TEXT, SHOW=1):
  238.         if SHOW == 1:
  239.             print(f"\033[0;32;1m{TEXT}\033[0m")
  240.     def 打印_黄(TEXT, SHOW=1):
  241.         if SHOW == 1:
  242.             print(f"\033[0;33;1m{TEXT}\033[0m")
  243.     def 打印_蓝(TEXT, SHOW=1):
  244.         if SHOW == 1:
  245.             print(f"\033[0;34;1m{TEXT}\033[0m")
  246.     def 打印_紫(TEXT, SHOW=1):
  247.         if SHOW == 1:
  248.             print(f"\033[0;35;1m{TEXT}\033[0m")
  249.     def 打印_青(TEXT, SHOW=1):
  250.         if SHOW == 1:
  251.             print(f"\033[0;36;1m{TEXT}\033[0m")
  252.     def 打印_白(TEXT, SHOW=1):
  253.         if SHOW == 1:
  254.             print(f"\033[0;37;1m{TEXT}\033[0m")
  255.     
  256.     def 打印_白底黑字(TEXT, SHOW=1):
  257.         if SHOW == 1:
  258.             print(f"\033[0;30;47m{TEXT}\033[0m")
  259.     def 打印_白底红字(TEXT, SHOW=1):
  260.         if SHOW == 1:
  261.             print(f"\033[0;31;47m{TEXT}\033[0m")
  262.     def 打印_白底绿字(TEXT, SHOW=1):
  263.         if SHOW == 1:
  264.             print(f"\033[0;32;47m{TEXT}\033[0m")
  265.     def 打印_白底黄字(TEXT, SHOW=1):
  266.         if SHOW == 1:
  267.             print(f"\033[0;33;47m{TEXT}\033[0m")
  268.     def 打印_白底蓝字(TEXT, SHOW=1):
  269.         if SHOW == 1:
  270.             print(f"\033[0;34;47m{TEXT}\033[0m")
  271.     def 打印_白底紫字(TEXT, SHOW=1):
  272.         if SHOW == 1:
  273.             print(f"\033[0;35;47m{TEXT}\033[0m")
  274.     def 打印_白底青字(TEXT, SHOW=1):
  275.         if SHOW == 1:
  276.             print(f"\033[0;36;47m{TEXT}\033[0m")

声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/酷酷是懒虫/article/detail/891691
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号