From ae76b4129471831fd03edb19cf10b3a86d119417 Mon Sep 17 00:00:00 2001
From: Christopher Wellons <wellons@nullprogram.com>
Date: Wed, 6 Feb 2019 15:18:09 -0500
Subject: [PATCH] Add a log parsing utility

---
 util/pivot.py   | 35 +++++++++++++++++++++++++++++++++++
 util/schema.sql |  8 ++++++++
 2 files changed, 43 insertions(+)
 create mode 100755 util/pivot.py
 create mode 100644 util/schema.sql

diff --git a/util/pivot.py b/util/pivot.py
new file mode 100755
index 0000000..4e3ab72
--- /dev/null
+++ b/util/pivot.py
@@ -0,0 +1,35 @@
+#!/usr/bin/env python3
+
+# This script accepts a log on standard input and produces a CSV table
+# with one connection per row.
+#
+#   $ util/pivot.py <log | sqlite3 -init util/schema.sql log.db
+
+import sys
+import pyrfc3339
+
+table = {}
+for line in sys.stdin:
+    parts = line.split(' ')
+    entry = {}
+    entry['logtime'] = pyrfc3339.parse(parts[0])
+    action = parts[1]
+    if action == 'ACCEPT' or action == 'CLOSE':
+        for item in parts[2:]:
+            key, value = item.split('=')
+            entry[key] = value
+        if action == 'ACCEPT':
+            table[entry['fd']] = entry
+        else:
+            accept = table[entry['fd']]
+            del table[entry['fd']]
+            delta = (entry['logtime'] - accept['logtime']).total_seconds()
+            host = entry['host']
+            port = entry['port']
+            if host.startswith('::ffff:'):
+                host = host[7:]
+            nbytes = int(entry['bytes'])
+            print('%s,%s,%.3f,%d' % (host, port, delta, nbytes))
+
+if len(table) > 0:
+    print('warning: %d hanging entries' % len(table), file=sys.stderr)
diff --git a/util/schema.sql b/util/schema.sql
new file mode 100644
index 0000000..78bf50a
--- /dev/null
+++ b/util/schema.sql
@@ -0,0 +1,8 @@
+CREATE TABLE IF NOT EXISTS log (
+    host TEXT,
+    port INTEGER,
+    time REAL,
+    bytes INTEGER
+);
+.mode csv
+.import /dev/stdin log