python分析nginx日志

    

#!/bin/env python
# coding=utf-8
import os, sys, time

def parser_log(filename, time_length, num):
    '''
    解析nginx访问日志，对指定时长内超过num次数的IP限制访问
    '''
    limit_length = 10240000   # 每次读取长度，防止内存占用过大
    stime = time.time() - int(time_length) * 60
    ips = {}

    f = open(filename)
    f.seek(0, 2)
    cur_pos = f.tell()
    first_length = 0
    n = 1

    while cur_pos > 0:
        cur_pos -= limit_length
        if cur_pos < 0:
            limit_length -= abs(cur_pos)
            n = 0
            cur_pos = 0
        f.seek(cur_pos)
        rs = f.read(limit_length + first_length).rstrip().split("\n")
        first_length = len(rs[0])
        for i in rs[n:][::-1]:
            log_time = time.mktime(time.strptime(i.split("[")[1].split()[0], "%d/%b/%Y:%H:%M:%S"))
            client_ip = i.split()[0]
            if log_time < stime:
                break
            if not ips.has_key(client_ip):
                ips[client_ip] = 0
            ips[client_ip] += 1
        if log_time < stime:
                break
    for k, v in sorted(ips.items(),key=lambda x:x[1],reverse=True):
        if v < int(num):
            break
        cmd = "/sbin/iptables -A INPUT -s %s -j DROP" % k
        os.system(cmd)

if __name__ == "__main__":
    parser_log(sys.argv[1], sys.argv[2], sys.argv[3])