# Copyright (c) 2014 Flowerfire, Inc. All Rights Reserved. akamai_web = { plugin_version = "1.1" info.1.manufacturer = "Akamai" info.1.device = "Web Server Log (W3C)" info.1.version = "" # 2014-04-07 - 1.0 - GMF - Created by cloning iisweb.cfg (v2.0.5) # 2014-04-25 - 1.1 - GMF - Added average_time_taken # The name of the log format log.format.format_label = "Akamai Web Server (W3C) Log Format" log.miscellaneous.log_data_type = "generic_w3c" log.miscellaneous.log_format_type = "web_server" # The log is in this format if any of the first ten lines match this regular expression. # 2014-04-07 - GMF - Autodetecting from #Fields now (No #Software line). Might be better to autodetect from the data; in particular, this has quoted fields while normal W3C Web doesn't quote fields ##Fields: date time cs-ip cs-method cs-uri sc-status sc-bytes time-taken cs(Referer) cs(User-Agent) cs(Cookie)" #2009-08-24 11:08:10 66.249.71.182 GET /www.defense.gov/ 200 12226 0 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" "-" log.format.autodetect_regular_expression = "^#Fields: date time cs-ip " # The format of dates and times in this log log.format.ignore_format_lines = "true" # 2014-04-07 - GMF - Akamai W3C logs quote fields (unlike normal W3C) [ThreadID:1299722] log.format.ignore_quotes = "false" # 2013-02-15 - GMF - Transplanted this from generic_w3c # This handles #Fields lines, and creates log and database fields from them log.filter_preprocessor = ` if (matches_regular_expression(current_log_line(), '^#Fields: +([^ ].*)$')) then ( string fields = $1; string fieldname; v.logfieldindex = 1; string numerical_fields = "profiles." . internal.profile_name . ".database.numerical_fields"; # Send this line to all parsing servers distribute_format_line(current_log_line()); # Reset all log fields to 0/0 so none carry over from the previous format line definition node log_fields = "profiles"{internal.profile_name}{"log"}{"fields"}; node log_field; foreach log_field log_fields ( @log_field{"index"} = 0; @log_field{"subindex"} = 0; ); # This subroutine creates a database field subroutine(create_database_field(string fieldname, int top, int bottom), ( #echo("create_database_field: " . fieldname); # debug debug_message("create_database_field(" . fieldname . ")\n"); string databasefieldpath = "profiles." . internal.profile_name . ".database.fields." . fieldname; (databasefieldpath . "") = ""; node databasefield = databasefieldpath; if (top ne 0) then set_subnode_value(databasefield, "suppress_top", top); if (bottom ne 0) then set_subnode_value(databasefield, "suppress_bottom", bottom); databasefield; )); subroutine(create_log_field(string fieldname, string type, bool withindex), ( debug_message("create_log_field(" . fieldname . "; type=" . type . ")\n"); # echo("create_log_field(" . fieldname . "; type=" . type . ")"); string logfieldpath = "profiles." . internal.profile_name . ".log.fields." . fieldname; (logfieldpath . "") = ""; node logfield = logfieldpath; if (withindex) then ( set_subnode_value(logfield, "index", v.logfieldindex); v.logfieldindex++; ); set_subnode_value(logfield, "subindex", 0); if (type ne '') then set_subnode_value(logfield, "type", type); logfield; )); # Get the log format separator. Assume at least two fields. # 2010-02-01 - GMF - Changed the default from " " to "" (any whitespace). With " " as the default, data which # has a spaces in the header, but tabs in the data, doesn't parse, because this assumes space # separators. Truly generic W3C header parsing appears to be impossible, which is why we can do # per-plugin parsing now; but that's just moved the problem here, where we'll still have to # fight it forever. Hopefully, "" gives better coverage to the universe of W3C variants than " ". # log.format.field_separator = " "; log.format.field_separator = ""; if (matches_regular_expression(fields, '^[^ ]+ [^ ]+')) then ( log.format.field_separator = " "; ); # Extract the fields on at a time while (matches_regular_expression(fields, '^([^ ]+)[ ](.*)$') or matches_regular_expression(fields, '^([^ ]+)$')) ( string unconverted_fieldname = $1; fields = $2; # Clean up the field name fieldname = ''; for (int i = 0; i < length(unconverted_fieldname); i++) ( string c = lowercase(substr(unconverted_fieldname, i, 1)); if (!matches_regular_expression(c, '^[a-z0-9]$')) then c = '_'; fieldname .= c; ); while (matches_regular_expression(fieldname, '^(.*)_$')) fieldname = $1; # Get the log field type string log_field_type = ''; # if (fieldname eq 'cs_referrer') then ( # fieldname = 'cs_referer'; # ); # if (fieldname eq 'cs_uri') then ( # fieldname = 'cs_uri_stem'; # ); # 2013-12-23 - GMF - Don't make cs_referrer type "referrer" anymore; we now do all referrer derivation in snapons, and this will create duplicate fields. # Create the log field # 2013-05-15 - GMF - We need to create these sc_bytes and cs_bytes log fields here, because otherwise web_server_package won't create the database fields. Why were they excluded? Maybe when this was copied from another plug-in which computes them from another field? # if ((fieldname ne "sc_bytes") and (fieldname ne "cs_bytes")) then create_log_field(fieldname, log_field_type, true); # If we're creating a profile, create the database fields too. if (node_exists("volatile.creating_profile")) then ( if (false) then ( ) # Don't track these fields in the database else if ((fieldname eq "sc_bytes") or (fieldname eq "cs_bytes") or (fieldname eq 'cs_uri_query') or (fieldname eq 'cs_cookie')) then ( ); # Handle date by creating date_time and derived database fields else if (fieldname eq "date") then ( # create_log_field('localtime', '', false); # placeholder - 7/Nov/2006 - KBB create_database_field('date_time', 0, 0); create_database_field('day_of_week', 0, 0); create_database_field('hour_of_day', 0, 0); ); # if date else if (fieldname eq "time") then ( create_database_field('date_time', 0, 0); create_database_field('day_of_week', 0, 0); create_database_field('hour_of_day', 0, 0); ); # if time # Don't include agent in database else if (fieldname eq "cs_user_agent") then ( # create_database_field('operating_system', 0, 0); ); # Create database field cs_referer and derived fields for referrer else if (fieldname eq "cs_referer") then ( create_database_field('cs_referer', 1, 9); ); else if (fieldname eq "cs_uri") then ( create_database_field('cs_uri', 0, 9); ); # Don't add a database field for numerical fields else if (subnode_exists(numerical_fields, fieldname)) then ( debug_message("Not adding numerical field: " . fieldname . "\n"); ); # Create a normal database field else create_database_field(fieldname, 0, 0); ); # if creating profile ); # while another field # Don't parse the #Fields line as a data line 'reject'; ); # if #Fields # Don't parse any other # lines as data lines else if (starts_with(current_log_line(), '#')) then ( 'reject'; ); ` # log.fields = { # hits = "" # } # log.fields # Log Filters log.filters = { # empty_uri_query = { # label = "$lang_admin.log_filters.empty_uri_query_label" # comment = "$lang_admin.log_filters.empty_uri_query_comment" # value = "if (cs_uri_query eq '-') then cs_uri_query = '(empty)';" # disabled = false # requires_fields = { # cs_uri_query = true # } # } # empty_uri_query # add_cs_uri_query = { # label = "$lang_admin.log_filters.add_cs_uri_query_label" # comment = "$lang_admin.log_filters.add_cs_uri_query_comment" # value = "cs_uri_stem = cs_uri_stem . '?' . cs_uri_query" # disabled = false # requires_fields = { # cs_uri_query = true # cs_uri_stem = true # } # } # add_cs_uri_query } # log.filters database.numerical_fields = { # hits = "" time_taken = { type = "int" integer_bits = 64 display_format_type = duration_milliseconds } # time_taken average_time_taken = { type = "int" integer_bits = 64 display_format_type = duration_milliseconds aggregation_method = "average" average_denominator_field = "hits" log_field = "time_taken" requires_log_field = false } # average_time_taken # time_taken_avg = { # label = "$lang_stats.field_labels.average $lang_stats.field_labels.time_taken" # default = false # log_field = "time_taken" # requires_log_field = true # type = "int" # integer_bits = 64 # aggregation_method = "average" # average_denominator_field = "hits" # display_format_type = duration_milliseconds # } # time_taken } # database.numerical_fields create_profile_wizard_options = { # How the reports should be grouped in the report menu report_groups = { date_time_group = "" content_group = { cs_uri = true } visitor_demographics_group = { cs_ip = true } referrer_group = { cs_referer = true } other_group = { cs_method = true sc_status = true cs_cookie = true } } # report_groups snapons = { # Attach a web_server_package snapon web_server_package = { snapon = "web_server_package" name = "web_server_package" label = "$lang_admin.snapons.web_server_package.label" parameters = { user_agent_field.parameter_value = "cs_user_agent" page_field.parameter_value = "cs_uri" client_ip_field.parameter_value = "cs_ip" server_response_field.parameter_value = "sc_status" referrer_field.parameter_value = "cs_referer" authenticated_user_field.parameter_value = "cs_username" hits_field = { parameter_value = "$lang_stats.field_labels.hits" final_node_name = "hits" } # hits visitors_field = { parameter_value = "$lang_stats.field_labels.unique_client_ips" final_node_name = "unique_client_ips" } # visitors_field sc_bytes_field = { parameter_value = "$lang_stats.field_labels.sc_bytes" final_node_name = "sc_bytes" } # sc_bytes_field cs_bytes_field = { parameter_value = "$lang_stats.field_labels.cs_bytes" final_node_name = "cs_bytes" } # cs_bytes_field } # parameters } # web_server_package } # snapons # final_step = ` #include "templates.admin.profiles.setup_reports_util"; # #string profile = "profiles." . volatile.new_profile_name; # ## Remove cs_uri_query and cs_cookie from the database fields #delete_database_field(profile, 'cs_uri_query'); #delete_database_field(profile, 'cs_cookie'); # ## Create the standard reports #add_standard_reports(profile); # ## Delete referrer filters if there's no referrer field ##if (!node_exists(profile . ".database.fields.referrer")) then ( ## (profile . ".log.filters.no_referrer.disabled") = true; ## (profile . ".log.filters.internal_referrer.disabled") = true; ##); # # ` # end final_step } # create_profile_wizard_options } # akamai_web