#! /usr/bin/perl

#
# This script read bind9 log-file and show stats about requests
# !!script uses PortableReadKey.pm library!!
#
# you should configure bind to log queries before use.
# set logging channel like in example:
# 
# logging {
#    channel query_log {
#        file "/var/log/bind/bind.log";
#        severity dynamic;
#        print-time yes;
#    };
#    category queries { query_log; };
# }
#
# Also you should set $logfile variable below
#
# version 0.1, copyright: valynkin pavel, 2015
#
my $logfile="/var/named/chroot/var/log/named/query.log";

use strict;
#use warnings;
#use Term::ANSIColor;
use IO::Handle;
use Switch;
use sigtrap qw/handler signal_handler normal-signals/;
sub signal_handler { close LOGFILE; PortableReadKey::turnOnEcho();  print "\nbye!\n"; exit;}

#
# Preferences
#
my $output_freq=1;
my $number_of_lines_to_print=5;
my $naptime = 1;
&set_view_to_default;
#
# declare global counters
my $cnt_connects = 0;       my $total_connects = 0;     my %IN_IP;
my $cnt_domains = 0;    my $total_domains = 0;  my %DOMAINS;
my $cnt_records=0;  my $total_records = 0;  my %RECORDS;
#
# declare global variables
my $line; my $pattern;
my $start_time = time(); my $last_print_time = $start_time; my $time_now;
my ($show_connects,$show_connects_details);
my ($show_domains,$show_domains_details);
my ($show_records,$show_records_details);
my $show_all_details;
my $instant_stats_window = "sec";
my $average_stats_window;
#
# Init PortableReadKey
#
use PortableReadKey;
PortableReadKey::getKeyInit();
PortableReadKey::clearScreen();
PortableReadKey::turnOffEcho();
my $key;
#
# Main cyrcle
#
open (LOGFILE, $logfile) or die "can't open $logfile: $!";
seek (LOGFILE,-1,2) or die "can't seek to the end of $logfile"; # go to the end of file
#print "\033[2J"; print "\033[0;0H"; # clear screen
PortableReadKey::clearScreen();
print "Collecting data, please wait $output_freq seconds...\n";
for (;;) {
    while (<LOGFILE>) { &count_stats ($_); } # read to EOF, parsing each line and count all counters

    $time_now=time(); # if time to output - do it
    if (($time_now-$last_print_time) >= $output_freq){ $last_print_time=$time_now;
    &output ();
    }

    sleep $naptime;
    LOGFILE->clearerr( ); # clear EOF flag
    &signal_handler if (stat(LOGFILE))[3] == 0; # exit if no links to logfile (nobody writes to file = so file has been rotated)
    #
    # Keyboard hooks
    #
    $key = PortableReadKey::getKeyNonBlocking();
    if ($key) {&keys_handler ($key);}
}

#
# Sub for parsing and coutnts
#
sub count_stats {
    my $hashref1;
    $line=$_[0]; chomp $line;
    #
    # count requests/sec
    #
    $pattern=".*client ([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)#.*";
    ($cnt_connects,$total_connects,$hashref1) =  &count ($cnt_connects,$total_connects,\%IN_IP);
    %IN_IP = %{$hashref1}; 
    #
    # count requested domains per second
    #
    $pattern="^.*client [0-9]+\.[0-9]+\.[0-9]+\.[0-9]+#[0-9]+: query: (?:[^\.]+\.)*?([^\.]+\.[^\.]+) IN .+";
    ($cnt_domains,$total_domains,$hashref1) = &count ($cnt_domains,$total_domains,\%DOMAINS);
    %DOMAINS = %{$hashref1};
    #
    # count requested records
    #
    $pattern=".*client [0-9]+\.[0-9]+\.[0-9]+\.[0-9]+#[0-9]+: query: (.+) IN .+";
    ($cnt_records,$total_records,$hashref1) =  &count ($cnt_records,$total_records,\%RECORDS);
    %RECORDS = %{$hashref1};
}

#
# Sub for output counters
#
sub output {
    my $instant_value;
    my $average_value;
#    print "\033[2J"; print "\033[0;0H"; # clear screen
    PortableReadKey::clearScreen();
    #
    # print requests per second
    #
    ($instant_value,$average_value) = &calculate ($cnt_connects,$total_connects);
    &print_to_screen ("(1)\e[1m \e[4mC\e[24monnects from IP:\t\tcurrent: $instant_value/$instant_stats_window\taverage: $average_value/$average_stats_window\t total: $total_connects \e[0m\n") if $show_connects == 1;
    &print_to_screen ("",\%IN_IP) if ($show_connects == 1 && $show_connects_details ==1);
    $cnt_connects=0;
    #
    # print requested domains
    #
    ($instant_value,$average_value) = &calculate ($cnt_domains,$total_domains);
    &print_to_screen ("(2)\e[1m \e[4mD\e[24momains requested: \e[0m \n") if $show_domains == 1;
    &print_to_screen ("",\%DOMAINS) if ($show_domains == 1 && $show_domains_details ==1);
    $cnt_domains=0;
    #
    # print requested records
    #
    ($instant_value,$average_value) = &calculate ($cnt_records,$total_records);
    &print_to_screen ("(3)\e[1m \e[4mR\e[24mecords requested: \e[0m \n") if $show_records == 1;
    &print_to_screen ("",\%RECORDS) if ( $show_records == 1 && $show_records_details ==1 );
    $cnt_records = 0;
    #
    # footer
    #
    $instant_value = time() - $start_time;
    &print_to_screen ("\nrefresh time: $output_freq sec.\ttime passed from start: $instant_value sec.\nplease type \e[1m?\e[0m or \e[1mh\e[0m for help or \e[1mq\e[0m to quit.\n");
}
#
# sub print_to_screen accepts following: <name_of_value> <value> <\%HASH_NAME>
#
sub print_to_screen {
#    my $name_of_value = $_[0];
#    my $value = $_[0];
#    print color 'bold';
    print "$_[0]";
#    print color 'reset';
    return if ( !$_[1] );
    my $count=1;
    foreach(sort {${$_[1]}{$b} <=> ${$_[1]}{$a}} keys %{$_[1]}) {
    print ${$_[1]}{$_},"\t",$_,"\n";
    last if $count>$number_of_lines_to_print; $count++;
    }
    print "\n";
}

sub count {
    my $numb_of_args = scalar (@_);
    my $conunter = shift;
    my $totals = shift;
    my %HASH = %{shift()};
    my %HASH1;
#    %HASH1 =  %{shift()} if ($numb_of_args > 3);
    %HASH1 =  %{@_[0]} if ($numb_of_args > 3);

    if  ($line =~ /$pattern/ ){ $conunter++; $totals++;
    my $a=$1; my $b=$2;
    if (exists($HASH{$a})){$HASH{$a}++;} else {$HASH{$a}=1;}
    if ($numb_of_args > 3) {if (exists($HASH1{$b})){$HASH1{$b}++;} else {$HASH1{$b}=1;}} 
    }

    return $conunter,$totals,\%HASH,\%HASH1 if ($numb_of_args > 3);
    return $conunter,$totals,\%HASH if ($numb_of_args <= 3);
}

sub calculate {
    my $cnt = shift;
    my $tot = shift;
    my $instant_value = sprintf "%.1f",($cnt/$output_freq);
    my $average_value;
    $average_value = ($average_stats_window eq "sec")?(sprintf "%.2f",($tot/($time_now-$start_time))):(sprintf "%.2f",($tot/(($time_now-$start_time)/60)));
    return $instant_value, $average_value;
}

sub helpscreen {
    PortableReadKey::clearScreen();
    print <<"HELP_SCREEN";
                \e[1m You can use folowing keys:\e[0m

C or c - show/hide Connects stats           1 - show/hide Connects details
D or d - show/hide Domains stats            2 - show/hide Domains details
R or r - show/hide Requests stats           3 - show/hide Requests details
A or a - show all stats                     4 or v - show/hide all details

0 or / - set screen to default view

M or m - switch average stats from per-minutes to per-seconds and back

\e[1m - \e[0m or \e[1m + \e[0m to increase/decrease display refresh interval by 5 second

\e[1m ? \e[0m or \e[1m h - \e[0m for this help
\e[1m q \e[0m - quit

press \e[1m ANYKEY \e[0m to continue..

\e[37m
\x1b[30m version 0.1, copyright: valynkin pavel, 2015\e[0m
HELP_SCREEN
    #<STDIN>;
PortableReadKey::getKeyBlocking();
    seek (LOGFILE,-1,2) # go forward to the end of file (to prevent harm stats if user see help screen too long)
}

sub keys_handler {
    my $key = shift;
    switch ($key) {
    case "q" {signal_handler;}
    case "+" {if ($output_freq >= 5) {$output_freq = $output_freq + 5;} else {$output_freq = $output_freq + 4;} }
    case "-" {if ($output_freq > 5) {$output_freq = $output_freq - 5;} else {$output_freq=1;} }
    case ["?","h"] {&helpscreen;}
    case ["M","m"] {$average_stats_window = ($average_stats_window eq "sec")?"min":"sec";}

    case ["C","c"] { $show_connects = !$show_connects; }
    case ["D","d"] { $show_domains = !$show_domains;}
    case ["R","r"] { $show_records = !$show_records;}
    case ["A","a"] {$show_connects = 1; $show_domains = 1; $show_records = 1; }
    case ["0","/"] {&set_view_to_default;}

    case "1" { $show_connects_details = !$show_connects_details; }
    case "2" { $show_domains_details = !$show_domains_details;}
    case "3" { $show_records_details = !$show_records_details;}
    case ["4","v"] { if ($show_all_details == 0) {$show_all_details=1;  $show_connects_details=1; $show_domains_details=1; $show_records_details=1; }
             else {$show_all_details=0; $show_connects_details=0; $show_domains_details=0; $show_records_details=0; }
               }
    }
}

sub set_view_to_default {
$show_connects = 1; $show_connects_details = 1;
$show_domains = 1; $show_domains_details = 1;
$show_records = 1; $show_records_details = 1;
$show_all_details = 0;
$average_stats_window = "min"; # must be "sec" or "min"
}