#!/usr/bin/perl
#

=pod

=head1 SUMMARY

Works with multilog to analyse and summarise log entries generated by the logterse plugin.  It is designed
to be invoked by multilog at log-rotation time.  This is specified by an argument to multilog similar to:

=over 4

multilog t !/path/to/qplogsumm ./main

=back

When qplogsumm is invoked, each line will be echoed, meaning the stored log is unchanged, but summary
information will be written to fd 5 and so stored in the 'state' file by multilog.

This file is fed in on fd 4 at the beginning of the next log rotation, so running totals, etc can be maintained.

=head1 State file format:

One entry per line containing three fields separated by whitespace:

=over 4

=item 1. Disposition (plugin) name.

=item 2. tai64n timestamp recording the first time it was seen in a log.

=item 3. long-term running total.

=back

A disposition is effectively the plugin name that called DENY or the string 'queued' for
messages that made it through.

A line containing a disposition name of LOGFILE_EPOCH and a timestamp for the earliest known log entry.

Other derived data, such as percentages etc. can also appear in the file, commented
by a # character.  This will be ignored on the next intake.

=head1 AUTHOR

Charles Butcher

=head1 VERSION

This is release 1.0

=cut

use strict;
use POSIX qw(strftime);


my $FS = "\t";	# field separator used by logterse plugin
my %disp;   	# hash of dispositions

if (open PREVIOUS, "<&4")
{
    while (<PREVIOUS>)
    {
	chomp();
	next if m/^#/;
	next if m/^\s*$/;
	my ($plug_name, $plug_epoch, $plug_cumulative) = split /\s+/;
	my $c = { epoch => $plug_epoch, cum => $plug_cumulative, curr => 0 };
	$disp{$plug_name} = $c;
    }

    close PREVIOUS;
}

my $first_timestamp = 0;
my $last_timestamp  = 0;


while (<>)
{
    print;
    chomp;
    next unless m/terse plugin/;

    my ($timestamp_part, $log_part) = split '`';
    my ($current_timestamp) = split /\s/, $timestamp_part;
    $first_timestamp = $current_timestamp unless $first_timestamp;
    $last_timestamp = $current_timestamp;

    my (@log_items) = split $FS, $log_part;
    my $disposition = $log_items[5];
    next unless defined $disposition;
    
    if ($disp{$disposition})
    {
	$disp{$disposition}->{curr} += 1;
    }
    else  # a new plugin -- make a note of when it first appeared
    {
	my $c = { epoch => $current_timestamp, cum => 0, curr => 1 };
	$disp{$disposition} = $c;
    }
}


#
# Set overall epoch
#
if (!exists $disp{'LOGFILE_EPOCH'})
{
    my $c = { epoch => $first_timestamp, cum => 0, curr => 0};
    $disp{'LOGFILE_EPOCH'} = $c;
}

my $current_total    = 0;
my $cumulative_total = 0;

open HOLDOVER, ">&5" and select HOLDOVER;

#
# Output cumulative values for intake the next time a log is processed
#
for my $c (keys %disp)
{
    $disp{$c}->{cum} += $disp{$c}->{curr};
    $current_total += $disp{$c}->{curr};
    $cumulative_total += $disp{$c}->{cum};

    printf "%-30.30s %s %12d\n", $c, $disp{$c}->{epoch}, $disp{$c}->{cum};
}

#
# Output current logfile stats
#

my $current_elapsed = tai64diff($last_timestamp, $first_timestamp);
exit 0 if ($current_elapsed == 0);

printf "#
# Most recent logfile
# -------------------
#
# Start  : %s
# Finish : %s
# Elapsed: %s
#
# Total transactions : %9d
# Average tx per hour: %9d
",
    tai64utc($first_timestamp),
    tai64utc($last_timestamp),
    seconds_to_days($current_elapsed),
    $current_total,
    $current_total / ($current_elapsed / 3600),
    ;

#
# Output cumulative log stats
#
my $cumulative_elapsed = tai64diff($last_timestamp, $disp{'LOGFILE_EPOCH'}->{epoch});

printf "#
# Cumulative Totals
# -----------------
#
# Start  : %s
# Finish : %s
# Elapsed: %s
#
# Total transactions : %12d
# Average tx per hour: %12d
",
    tai64utc($disp{'LOGFILE_EPOCH'}->{epoch}),
    tai64utc($last_timestamp),
    seconds_to_days($cumulative_elapsed),
    $cumulative_total,
    $cumulative_total / ($cumulative_elapsed / 3600),
    ;


# 
# Output per-plugin stats
#

print "#
#                                 Most Recent Logfile      Cumulative Totals
# Disposition (plugin)            Total       Avg/Day      Total       Avg/Day
# ----------------------------------------------------------------------------\n"; 

my $printf_format = "# %-30.30s %6d %3d%% %8d %10d %3d%% %8d\n";

foreach my $c (sort { $disp{$b}->{curr} <=> $disp{$a}->{curr} } keys %disp)
{
    next if ($c eq 'LOGFILE_EPOCH');

    printf $printf_format, 
    $c,
    $disp{$c}->{curr},
    $disp{$c}->{curr} / $current_total * 100,
    $disp{$c}->{curr} / ($current_elapsed / 86400),
    $disp{$c}->{cum},
    $disp{$c}->{cum} / $cumulative_total * 100,
    $disp{$c}->{cum} / (tai64diff($last_timestamp, $disp{$c}->{epoch}) / 86400),
    ;
}

print "# ----------------------------------------------------------------------------\n";
printf $printf_format, 
    'TOTALS',
    $current_total,
    100,
    $current_total / ($current_elapsed / 86400),
    $cumulative_total,
    100,
    $cumulative_total / ($cumulative_elapsed / 86400),
    ;

exit 0;


sub tai64utc {
    my ($s) = @_;

    # @400000003f6c7bc5253bf98c
    # 0123456789012345678901234
    # 0         1         2
    #   |-------------||------|
    if (substr($s, 0, 2) eq '@4') {
        my $ts = hex(substr($s, 2, 15));
        $s = strftime('%Y-%m-%d %H:%M:%S', gmtime($ts));
    }
    return $s;
}

#
# Return difference in seconds
#
sub tai64diff
{
    my ($s1, $s2) = @_;

    # @400000003f6c7bc5253bf98c
    # 0123456789012345678901234
    # 0         1         2
    #   |-------------||------|
    if (substr($s1, 0, 2) eq '@4' and substr($s2, 0, 2) eq '@4')
    {
        my $ts1 = hex(substr($s1, 2, 15));
        my $ts2 = hex(substr($s2, 2, 15));
	return $ts1 - $ts2;
    }
    else
    {
	return 0;
    }
}


#
# Return an english phrase representing a number of seconds
#
sub seconds_to_days
{
    my ($secs) = @_;

    my $phrase = sprintf "%d days, ", ($secs / 86400);
    $secs %= 86400;
    $phrase .= sprintf "%d hours, ", ($secs / 3600);
    $secs %= 3600;
    $phrase .= sprintf "%d mins, %d secs", ($secs / 60), ($secs % 60);
}