3 Commits
5 changed files with 188 additions and 78 deletions
+45 -15
View File
@@ -1,20 +1,50 @@
LumberJack TUI takes in an Apache2 access log file and provides an interactive interface to check your logs. # LumberJack TUI
MacOS Users: LumberJack TUI reads Apache 2 access logs and provides an interactive interface for exploring them.
- Unfortunately, I don't want to have to setup my pc to build your executable for you. So, the CMakeLists.txt file will autobuild an executable for you :)
All Other Users: ## Building on Windows
- I have packaged executables into the released .zip files
NOTES: You need CMake, Ninja, and MinGW-w64 with `g++` available on your `PATH`.
- The TUI will ask for the access.log file location and the GeoLite2-City.mmdb file location on startup. It will then create local lumberjack.config file with the locations you provided. If you mess up, just change them in the lumberjack.config for now.
* I have not tried using the GeoLite2-Country.mmdb file and do not know if it will crash the application... From the repository root, run:
- Log line format example:
172.71.245.109 - - [23/Jan/2016:09:49:24 +0100] "GET /favicon.ico HTTP/1.1" 301 642 "-" "Mozilla/5.0 (Linux; Android 10; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Safari/15.0.0.0 Safari/537.36" ```powershell
* This is the only format I have setup for the regex so far. It works on both my Apache2 and Gitea access logs but I do not know a whole lot about access log formats. .\scripts\build.ps1
```
This builds the Release executable and refreshes the root `compile_commands.json` for clangd. To build Debug or choose a different build directory, use:
```powershell
.\scripts\build.ps1 -Configuration Debug
.\scripts\build.ps1 -BuildDirectory build-custom
```
By default, the executable is written to `build-ninja\bin\release\LumberJack.exe`.
## Other platforms
- **macOS:** CMake is configured to build the executable for you.
- **Other users:** Prebuilt executables are available in the ZIP files under [`Releases`](Releases/).
## Configuration
On startup, the TUI asks for the locations of your `access.log` file and `GeoLite2-City.mmdb` database. It saves these locations to `lumberjack.config`; edit that file if you need to correct them.
The `GeoLite2-Country.mmdb` database has not been tested and may not work.
## Supported log format
The parser currently expects an Apache-style access log format, such as:
```text
172.71.245.109 - - [23/Jan/2016:09:49:24 +0100] "GET /favicon.ico HTTP/1.1" 301 642 "-" "Mozilla/5.0 (Linux; Android 10; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Safari/15.0.0.0 Safari/537.36"
```
This format has been tested with Apache 2 and Gitea access logs. Other formats may not be parsed correctly.
## Planned improvements
FUTURE CHANGES:
- Ban IP functionality - Ban IP functionality
- Live .log file changing - Live `.log` file updates
- Refactor config.cpp to find .log files from a dierectory - Find `.log` files in a directory from `config.cpp`
- Add a function to unarchive, archived logs. - Unarchive archived logs
+81 -57
View File
@@ -1,3 +1,5 @@
#include <algorithm>
#include <cstddef>
#include <cstdlib> #include <cstdlib>
#include <iostream> #include <iostream>
#include <fstream> #include <fstream>
@@ -11,72 +13,94 @@
#include "log_parsing.hpp" #include "log_parsing.hpp"
#include "../ip_to_geo/ip_to_geo.hpp" #include "../ip_to_geo/ip_to_geo.hpp"
p_logs::p_logs(std::string log_path) { p_logs::p_logs(std::string dir_path) {
if(log_path.empty()){ if(dir_path.empty()){
log_path = std::getenv("LOG_PATH"); const char* dir_val = std::getenv("LOG_PATH");
} if(dir_val != nullptr){
std::ifstream file(log_path); dir_path = dir_val;
if (!file.is_open()) { } else {
std::ofstream error_file("error.log", std::ios::app); std::ofstream error_file("error.log", std::ios::app);
if (error_file.is_open()) { if (error_file.is_open()) {
auto now = std::chrono::system_clock::now(); auto now = std::chrono::system_clock::now();
std::time_t now_time = std::chrono::system_clock::to_time_t(now); std::time_t now_time = std::chrono::system_clock::to_time_t(now);
error_file << "[" << std::put_time(std::localtime(&now_time), "%Y-%m-%d %H:%M:%S") << "] " error_file << "[" << std::put_time(std::localtime(&now_time), "%Y-%m-%d %H:%M:%S") << "] "
<< "Log file failed to load at: " << log_path << std::endl; << "Log files failed to load in: " << dir_path << std::endl;
error_file.close();
error_file.close(); }
} return;
return;
}
std::regex log_pattern(R"((\S+)\s+-\s+-\s+\[([^\]]+)\]\s+\"([^\"]+)\"\s+(\d+)\s+(\d+|-)\s+\"([^\"]*)\"\s+\"([^\"]*)\")");
std::string line;
std::smatch match;
while (getline(file, line)) {
if (regex_search(line, match, log_pattern)) {
Entry current_entry;
current_entry.ip = match[1].str();
current_entry.timestamp = match[2].str();
current_entry.request = match[3].str();
current_entry.status = match[4].str();
current_entry.bytes = match[5].str();
current_entry.referer = match[6].str();
std::string raw_ua = match[7].str();
if (raw_ua.find("Windows NT 10.0") != std::string::npos) current_entry.os = "Windows 10/11";
else if (raw_ua.find("Windows NT 6.1") != std::string::npos) current_entry.os = "Windows 7";
else if (raw_ua.find("iPhone") != std::string::npos) current_entry.os = "iOS (iPhone)";
else if (raw_ua.find("iPad") != std::string::npos) current_entry.os = "iOS (iPad)";
else if (raw_ua.find("Android") != std::string::npos) current_entry.os = "Android";
else if (raw_ua.find("Macintosh") != std::string::npos) current_entry.os = "macOS";
else if (raw_ua.find("Linux") != std::string::npos) current_entry.os = "Linux";
else current_entry.os = "Unknown OS";
if (raw_ua.find("Edg/") != std::string::npos) current_entry.browser = "Microsoft Edge";
else if (raw_ua.find("OPR/") != std::string::npos) current_entry.browser = "Opera";
else if (raw_ua.find("Chrome/") != std::string::npos) current_entry.browser = "Google Chrome";
else if (raw_ua.find("Safari/") != std::string::npos) current_entry.browser = "Apple Safari";
else if (raw_ua.find("Firefox/") != std::string::npos) current_entry.browser = "Mozilla Firefox";
else if (raw_ua.find("curl/") != std::string::npos) current_entry.browser = "curl (CLI Tool)";
else current_entry.browser = "Unknown Browser/Bot";
current_entry.location = iplookup(current_entry.ip);
logs.push_back(current_entry);
} }
} }
file.close();
for(const auto& log_path : p_logs::log_paths){
std::ifstream file(log_path);
if (!file.is_open()) {
std::ofstream error_file("error.log", std::ios::app);
if (error_file.is_open()) {
auto now = std::chrono::system_clock::now();
std::time_t now_time = std::chrono::system_clock::to_time_t(now);
error_file << "[" << std::put_time(std::localtime(&now_time), "%Y-%m-%d %H:%M:%S") << "] "
<< "Log file failed to load at: " << log_path << std::endl;
error_file.close();
}
continue;
}
std::regex log_pattern(R"((\S+)\s+-\s+-\s+\[([^\]]+)\]\s+\"([^\"]+)\"\s+(\d+)\s+(\d+|-)\s+\"([^\"]*)\"\s+\"([^\"]*)\")");
std::string line;
std::smatch match;
while (getline(file, line)) {
if (regex_search(line, match, log_pattern)) {
Entry current_entry;
current_entry.ip = match[1].str();
current_entry.timestamp = match[2].str();
current_entry.request = match[3].str();
current_entry.status = match[4].str();
current_entry.bytes = match[5].str();
current_entry.referer = match[6].str();
std::string raw_ua = match[7].str();
if (raw_ua.find("Windows NT 10.0") != std::string::npos) current_entry.os = "Windows 10/11";
else if (raw_ua.find("Windows NT 6.1") != std::string::npos) current_entry.os = "Windows 7";
else if (raw_ua.find("iPhone") != std::string::npos) current_entry.os = "iOS (iPhone)";
else if (raw_ua.find("iPad") != std::string::npos) current_entry.os = "iOS (iPad)";
else if (raw_ua.find("Android") != std::string::npos) current_entry.os = "Android";
else if (raw_ua.find("Macintosh") != std::string::npos) current_entry.os = "macOS";
else if (raw_ua.find("Linux") != std::string::npos) current_entry.os = "Linux";
else current_entry.os = "Unknown OS";
if (raw_ua.find("Edg/") != std::string::npos) current_entry.browser = "Microsoft Edge";
else if (raw_ua.find("OPR/") != std::string::npos) current_entry.browser = "Opera";
else if (raw_ua.find("Chrome/") != std::string::npos) current_entry.browser = "Google Chrome";
else if (raw_ua.find("Safari/") != std::string::npos) current_entry.browser = "Apple Safari";
else if (raw_ua.find("Firefox/") != std::string::npos) current_entry.browser = "Mozilla Firefox";
else if (raw_ua.find("curl/") != std::string::npos) current_entry.browser = "curl (CLI Tool)";
else current_entry.browser = "Unknown Browser/Bot";
current_entry.location = iplookup(current_entry.ip);
logs.push_back(current_entry);
}
}
file.close();
}
} }
std::vector<Entry> p_logs::get_all_logs(){ std::vector<Entry> p_logs::get_all_logs(){
return logs; return logs;
} }
std::vector<std::filesystem::path> p_logs::get_log_paths(){
return log_paths;
}
std::string p_logs::entryx_ip(int x){ std::string p_logs::entryx_ip(int x){
return logs[x].ip; return logs[x].ip;
} }
+10 -2
View File
@@ -10,6 +10,7 @@
*/ */
#pragma once #pragma once
#include <filesystem>
#include <string> #include <string>
#include <vector> #include <vector>
#include "../ip_to_geo/ip_to_geo.hpp" #include "../ip_to_geo/ip_to_geo.hpp"
@@ -30,17 +31,24 @@ class p_logs {
private: private:
Entry entry; Entry entry;
std::vector<Entry> logs; std::vector<Entry> logs;
std::string url; std::vector<std::filesystem::path> log_paths;
public: public:
/** /**
* @brief Construct a new parsed logs object * @brief Construct a new parsed logs object
* Detailed explanation: This function takes in the absolute path to a .log file and parses the lines into individual "Entry"s. These Entrys are then stored into a vector that can then be accessed via getter functions. * Detailed explanation: This function takes in the path to the access log directory parses the lines into individual "Entry"s. These Entrys are then stored into a vector that can then be accessed via getter functions.
* @param string * @param string
*/ */
p_logs(std::string); p_logs(std::string);
std::vector<Entry> get_all_logs(); std::vector<Entry> get_all_logs();
/**
* @brief Get the log paths object
* Detailed explanation: This function returns all of the paths to the log files in the user provided directory.
* @return std::vector<std::filesystem::path>
*/
std::vector<std::filesystem::path> get_log_paths();
/** /**
* @brief Getter function for a specific Entry's IP * @brief Getter function for a specific Entry's IP
* *
+4 -4
View File
@@ -209,14 +209,14 @@ int main() {
// ── 4. Setup-screen components ──────────────────────────────────────────── // ── 4. Setup-screen components ────────────────────────────────────────────
Component input_log = Input(&log_file_path, "Enter path to log file..."); auto input_log = Input(&log_file_path, "Enter path to log file...");
Component input_mmdb = Input(&mmdb_path, "Enter path to MaxMind MMDB..."); auto input_mmdb = Input(&mmdb_path, "Enter path to MaxMind MMDB...");
Component submit_button = Button(" Start Log Monitor ", run_log_parsing, ButtonOption::Animated()); auto submit_button = Button(" Start Log Monitor ", run_log_parsing, ButtonOption::Animated());
auto setup_container = Container::Vertical({input_log, input_mmdb, submit_button}); auto setup_container = Container::Vertical({input_log, input_mmdb, submit_button});
// ── 5. Search input (dashboard) ─────────────────────────────────────────── // ── 5. Search input (dashboard) ───────────────────────────────────────────
Component search_input = Input(&search_query, "Type to filter records (IP, request, status, etc.)..."); auto search_input = Input(&search_query, "Type to filter records (IP, request, status, etc.)...");
// ── 6. Main renderer ────────────────────────────────────────────────────── // ── 6. Main renderer ──────────────────────────────────────────────────────
auto main_components = Container::Vertical({ auto main_components = Container::Vertical({
+48
View File
@@ -0,0 +1,48 @@
param(
[ValidateSet("Debug", "Release")]
[string]$Configuration = "Release",
[string]$BuildDirectory = "build-ninja"
)
$ErrorActionPreference = "Stop"
if (-not (Get-Command cmake -ErrorAction SilentlyContinue)) {
Write-Error "CMake was not found. Install CMake and ensure it is on PATH."
exit 1
}
$sourceDirectory = Split-Path -Parent $PSScriptRoot
if ([System.IO.Path]::IsPathRooted($BuildDirectory)) {
$buildPath = $BuildDirectory
} else {
$buildPath = Join-Path $sourceDirectory $BuildDirectory
}
$configureArgs = @(
"-S", $sourceDirectory,
"-B", $buildPath,
"-G", "Ninja",
"-DCMAKE_CXX_COMPILER=g++",
"-DCMAKE_BUILD_TYPE=$Configuration"
)
& cmake @configureArgs
if ($LASTEXITCODE -ne 0) {
exit $LASTEXITCODE
}
$compilationDatabase = Join-Path $buildPath "compile_commands.json"
if (-not (Test-Path $compilationDatabase)) {
Write-Error "CMake did not generate compile_commands.json at '$compilationDatabase'."
exit 1
}
Copy-Item -LiteralPath $compilationDatabase -Destination (Join-Path $sourceDirectory "compile_commands.json") -Force
& cmake --build $buildPath --config $Configuration
if ($LASTEXITCODE -ne 0) {
exit $LASTEXITCODE
}
$outputPath = Join-Path $buildPath "bin\$($Configuration.ToLowerInvariant())\LumberJack.exe"
Write-Host "Build complete: $outputPath"
Write-Host "Updated compile_commands.json for clangd."