Listing 3: Parser for netstat log file

#!/usr/local/bin/perl -w

#
#  netstats_log_to_stats.pl  -  Parse the log made by netstat into
#                               columns suitable for plotting.
#
#     Usage:  netstats_log_to_stats.pl <logfile>
#
#     Example:
#
#        % netstats_log_to_stats.pl netstats.messages > netstats.dat
#
#     Input file:
#
#          ctime   OutPkts Collisions
#        --------- ------- ----------
#        883637463 2612755 50267
#        883641065 2615088 50369
#        883644663 2617414 50501
#        883648263 2619748 50575
#
#     Output file:
#                           %collis    collis    total
#          ctime      day   per min   this min  collis
#        ---------   -----  -------   --------  ------
#        883641065    0.04    0.07       102     50369
#        883644663    0.08    0.09       132     50501
#        883648263    0.12    0.05       74      50575


$OutPkts = 0;
$Collis = 0;
$OutPkts_prev = 0;
$Collis_prev = 0;
$time_prev = 0;

while (<>) {

if (/\d+/) {
# Incoming lines look like this:
#     ctime   OutPkts Collisions
#   --------- ------- ----------
#   873077544  94257  462

($statdate, $OutPkts, $Collis) = split();

# Only set $FirstStatDate once, so that you can string multiple
# invocations together
if (!(defined $FirstStatDate)) { $FirstStatDate = $statdate; }

if (($OutPkts < $OutPkts_prev) || ($statdate == $FirstStatDate)) {

# Then the host was rebooted.  Instead of printing this entry,
# output a blank line. Go ahead and set the prev variables so
# that the subsequent statistics will be relative to the
# skipped entry.

print "\n";

} else {

# This is the usual case
$OutPkts_this_entry = $OutPkts - $OutPkts_prev;
$Collis_this_entry = $Collis - $Collis_prev;
$seconds_this_entry = $statdate - $time_prev;
$minutes_this_entry = ($seconds_this_entry / 60);
$Collis_Ptg_per_minute_this_entry =
(($Collis_this_entry / $OutPkts_this_entry) * 100) /
$minutes_this_entry;

# convert seconds --> days
$statday = (($statdate - $FirstStatDate)/60/60/24);

printf "%d\t%.2f\t%.2f\t%d\t%d\n", $statdate, $statday,
$Collis_Ptg_per_minute_this_entry,
$Collis_this_entry, $Collis;
}

$OutPkts_prev = $OutPkts;
$Collis_prev = $Collis;
$time_prev = $statdate;
}
}

# End of File