#
# $Id: Apache.pm,v 1.3 2002/03/14 10:14:11 fpmip Exp $
#

# Author : Tycho Fruru <tycho@fruru.com>

# Copyright (C) 2001 Tycho Fruru <tycho@fruru.com>
# Copyright (C) 2001 Conostix S.A. Luxembourg - Tycho Fruru <tycho@conostix.com>

# This program is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by the
# Free Software Foundation; either version 2 of the License, or (at your
# option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
#
# This program is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
# or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
# for more details.
#

package IPFC::Parse::Event::Apache;

use strict;
use warnings;
use IPFC::Log;

sub parse($$) {
	shift; # current class
	my $apache_line = shift;
	my $template_event = shift;
	
	# make local copies so that we don't pollute the global variables
	my $event = $template_event; # ->clone;
	
	my $rc = 1;
	
	my $apache_virtual = "";
	my $apache_host;
	my $apache_logname;
	my $apache_username;
	my $apache_time;
	my $apache_url;
	my $apache_status;
	my $apache_bytes;
	my $apache_referer = "-";
	my $apache_user_agent = "-";
			
	if ($apache_line =~ /^(\S+) (\S+) (\S+) \[([^\]]+)\] \"(.*)\" (\d+) (\S+) \"(.*)\" \"(.*)\"$/) {
# Combined log : "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\""
		$apache_host = $1;
		$apache_logname = $2;
		$apache_username = $3;
		$apache_time = $4;
		$apache_url = $5;
		$apache_status = $6;
		$apache_bytes = $7;
		$apache_referer = $8;
		$apache_user_agent = $9;
	} elsif ($apache_line =~ /^(\S+) (\S+) (\S+) \[([^\]]+)\] (\S+) \"(.*)\" (\d+) (\S+)$/) {
# CLF with virtual host : %v %h %l %u %t \"%r\" %>s %b
		$apache_virtual = $1;
		$apache_host = $2;
		$apache_logname = $3;
		$apache_username = $4;
		$apache_time = $5;
		$apache_url = $6;
		$apache_status = $7;
		$apache_bytes = $8;
	} elsif ($apache_line =~ /^(\S+) (\S+) (\S+) \[([^\]]+)\] \"(.*)\" (\d+) (\S+)$/) {
# CLF : %h %l %u %t \"%r\" %>s %b
		$apache_host = $1;
		$apache_logname = $2;
		$apache_username = $3;
		$apache_time = $4;
		$apache_url = $5;
		$apache_status = $6;
		$apache_bytes = $7;
	} else {
		IPFC::Log::logger(1,"No applicable apache_access_log format for ".$apache_line);
		return 0;
	};
			
	if ($apache_bytes eq "-") {
		$apache_bytes = 0;
	}

	$event->add_attributes( { "message" 		=> $apache_line,
				  "virtual_host" 	=> $apache_virtual,
				  "src_host"		=> $apache_host,
				  "remote_logname"	=> $apache_logname,
				  "remote_username"	=> $apache_username,
				  "url"			=> $apache_url,
				  "http_status" 	=> $apache_status,
				  "bytes_sent" 		=> $apache_bytes,
				  "referer" 		=> $apache_referer,
				  "user_agent" 		=> $apache_user_agent });

# apache time format : 17/May/2001:22:56:54 +0200 , directly understood by postgresql

	if ($apache_time =~ /^\d+\/\w+\/\d+:\d+:\d+:\d+ [+-]\d+$/) {
		$event->replace_attributes({ "time" => $apache_time });
	} else {
		IPFC::Log::logger(1,"Apache time spec $apache_time not acceptable\n");
	}
			
			
	
#	IPFC::Log::logger(10,"End of apache_access_log_1, returning $rc");
	
	return $event; # 1 is ok, 0 is not ok
}

return 1;
