Powershell IIS日志analasys

Question

我几乎已经完成了这个Powershell脚本，但我坚持在最后一部分，可以真正使用一些帮助的最后一步。下面是我写到目前为止

$t1 =(get-date).AddMinutes(-10) 
$t2 =$t1.ToUniversalTime().ToString("HH:mm:ss") 
$IISLogPath = "C:\inetpub\logs\LogFiles\W3SVC1\"+"u_ex"+(get-date).ToString("yyMMdd")+".log" 
$IISLogFileRaw = [System.IO.File]::ReadAllLines($IISLogPath) 
$headers = $IISLogFileRaw[3].split(" ") 
$headers = $headers | where {$_ -ne "#Fields:"} 
$IISLogFileCSV = Import-Csv -Delimiter " " -Header $headers -Path $IISLogPath 
$IISLogFileCSV = $IISLogFileCSV | where {$_.date -notlike "#*"} 
$timeTaken = $IISLogFileCSV | where {$_.("cs-uri-stem") -eq '/Login.aspx' -AND $_.("time") -gt '$t2' } | Format-Table time,s-ip 

所以基本上是着眼于当前天IIS日志和过滤器，当用户获取到登录页面，在过去10分钟我的PS脚本。我坚持的部分是我想通过电子邮件发送当IP在10分钟内击中它10次以上（基本上是在发生暴力攻击时发出警报）。我写的代码中的电子邮件部分只需要说明s-ip命中/login.aspx的时间大于10次的部分。此外，在我的“测试箱”我已经改变$t2和$IISLogPath为以下

$t2 = 20:00:00 
$IISLogPath = C:\test\log.log 

下面是我的示例日志文件：

#Software: Microsoft Internet Information Services 7.5 
#Version: 1.0 
#Date: 2012-06-27 15:05:24 
#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status time-taken 
2012-06-27 20:32:35 ::1 GET /Login.aspx - 80 - ::1 Mozilla/5.0+(Windows+NT+6.1;+WOW64;+rv:13.0)+Gecko/20100101+Firefox/13.0.1 500 0 0 24240 
2012-06-27 20:32:35 ::1 GET /Login.aspx - 80 - ::1 Mozilla/5.0+(Windows+NT+6.1;+WOW64;+rv:13.0)+Gecko/20100101+Firefox/13.0.1 500 0 0 24240 
2012-06-27 20:32:35 ::1 GET /Login.aspx - 80 - ::1 Mozilla/5.0+(Windows+NT+6.1;+WOW64;+rv:13.0)+Gecko/20100101+Firefox/13.0.1 500 0 0 24240 
2012-06-27 20:32:35 ::1 GET /Login.aspx - 80 - ::1 Mozilla/5.0+(Windows+NT+6.1;+WOW64;+rv:13.0)+Gecko/20100101+Firefox/13.0.1 500 0 0 24240 
2012-06-27 21:32:35 ::1 GET /Login.aspx - 80 - ::1 Mozilla/5.0+(Windows+NT+6.1;+WOW64;+rv:13.0)+Gecko/20100101+Firefox/13.0.1 500 0 0 24240 
2012-06-27 21:32:35 ::1 GET /Login.aspx - 80 - ::1 Mozilla/5.0+(Windows+NT+6.1;+WOW64;+rv:13.0)+Gecko/20100101+Firefox/13.0.1 500 0 0 24240 
2012-06-27 21:32:35 ::1 GET /Login.aspx - 80 - ::1 Mozilla/5.0+(Windows+NT+6.1;+WOW64;+rv:13.0)+Gecko/20100101+Firefox/13.0.1 500 0 0 24240 
2012-06-27 21:32:35 ::1 GET /Login.aspx - 80 - ::1 Mozilla/5.0+(Windows+NT+6.1;+WOW64;+rv:13.0)+Gecko/20100101+Firefox/13.0.1 500 0 0 24240 
2012-06-27 21:32:35 ::1 GET /Login.aspx - 80 - ::1 Mozilla/5.0+(Windows+NT+6.1;+WOW64;+rv:13.0)+Gecko/20100101+Firefox/13.0.1 500 0 0 24240 
2012-06-27 21:32:35 ::1 GET /Login.aspx - 80 - ::1 Mozilla/5.0+(Windows+NT+6.1;+WOW64;+rv:13.0)+Gecko/20100101+Firefox/13.0.1 500 0 0 24240 
2012-06-27 21:32:35 ::1 GET /Login.aspx - 80 - ::1 Mozilla/5.0+(Windows+NT+6.1;+WOW64;+rv:13.0)+Gecko/20100101+Firefox/13.0.1 500 0 0 24240 
2012-06-27 21:32:35 ::1 GET /Login.aspx - 80 - ::1 Mozilla/5.0+(Windows+NT+6.1;+WOW64;+rv:13.0)+Gecko/20100101+Firefox/13.0.1 500 0 0 24240 
2012-06-27 21:32:35 ::1 GET /Login.aspx - 80 - ::1 Mozilla/5.0+(Windows+NT+6.1;+WOW64;+rv:13.0)+Gecko/20100101+Firefox/13.0.1 500 0 0 24240 
2012-06-27 21:32:35 ::1 GET /Login.aspx - 80 - ::1 Mozilla/5.0+(Windows+NT+6.1;+WOW64;+rv:13.0)+Gecko/20100101+Firefox/13.0.1 500 0 0 24240 
2012-06-27 21:32:35 ::1 GET /Login.aspx - 80 - ::1 Mozilla/5.0+(Windows+NT+6.1;+WOW64;+rv:13.0)+Gecko/20100101+Firefox/13.0.1 500 0 0 24240 

Answer 1

经过对脚本的修改，我找到了解决方案。下面是整个脚本

$t1 =(get-date).AddMinutes(-10) 
$t2 =$t1.ToUniversalTime().ToString("HH:mm:ss") 
$IISLogPath = "C:\inetpub\logs\LogFiles\W3SVC1\"+"u_ex"+(get-date).ToString("yyMMdd")+".log" 
$IISLogFileRaw = [System.IO.File]::ReadAllLines($IISLogPath) 
$headers = $headers | where {$_ -ne "#Fields:"} 
$IISLogFileCSV = Import-Csv -Delimiter " " -Header $headers -Path $IISLogPath 
$IISLogFileCSV = $IISLogFileCSV | where {$_.date -notlike "#*"} 
$timeTaken = ($IISLogFileCSV | where {$_.("cs-uri-stem") -eq '/Login.aspx' -AND $_.("time") -gt '$t2' -AND $_.("cs-method") -eq 'Get'}).count 
$count = $timeTaken 
if($count -ge 8) 
{ 
Send-MailMessage -From [email protected] -To [email protected] -Subject "IIS Alert" -BodyAsHtml "Email body goes here" -Attachments $IISLogPath -SmtpServer ip.add.re.ss 
} 

Answer 2

你应该使用Microsoft LogParser大多数繁重的工作在解析/查询您的日志文件。它会为你节省很多的痛苦，并且可能会更快地启动。

你可以用PowerShell包装它来解析你的查询结果。