Access Log Processor and Metrics Generator
There are 3 main use cases (profiles) supported by this tool:
- Counter mode (when -p=count option is provided): Counts logs from an access log file and prints statistics to stdout every 30 seconds
- Metrics generator (when -p=metrics option is provided): Processes logs from an access log file (or files) and generates metrics, which can be saved into a mysql database to be used with SBOanalytics (a web front-end for metrics) or just printed to stdout.
- Security mode (when -p=security option is provided): (Not implemented yet) Processes logs from an access log file and outputs potential security issues (e.g abuser, stats on sql injection attempts etc) giving you a list of IPs and/or patterns that you may want to block
# Usage
Download a precompiled binary from releases page, unzip/untar and execute sbologp (or sbologp.exe on windows) command.
Run sbologp -h to see available command line options.
There are too many options which may not have a corresponding command line parameter so if you need more control, passing a configuration file using -c option might be required.
See https://github.com/SBOsoft/SBOLogProcessor/tree/main/conf/example-config-file.json for configuration examples. Configuration must be a json map, with file paths as keys.
Examples assume you are running a linux, e.g ubuntu.
Run in counter mode and follow changes, print stats every 30 seconds:
./sbologp -f -p=count /var/log/apache2/access.log
Run in counter mode without following changes, print total stats:
./sbologp -p=count /var/log/apache2/access.log
Run in the background using configuration file:
nohup ./sbologp -f -c sbologp-config.json &
nohup will ensure the program continues to run in the background even after your session ends, e.g your ssh connection is disconnected.
Install go first, then clone the project from github.
Build
go build -o ./output/bin/sbologp
Clean
go clean
Use go run . -option1 -option2 path-to-access-log-file
For example:
go run . -f -h=COUNTER -p=count /var/log/apache2/access.log
Print stats from the given log file every 30 seconds (follow changes).
go run . -f -p count /var/log/apache2/example.com-access.log
Print total stats from the given log file.
go run . -p count /var/log/apache2/example.com-access.log
go test ./... in project root folder or go test ./... in a sub-folder.
Do NOT expect high test coverage.