Hello,
For those who want the statistics about the viruses catched
from ClamAV.
Thank you for everyone the help me. Here is my two cents of help.
Ronan
---------------------------------------------------------
#!/usr/local/bin/python
#
################################################################################
# This script was developed to show the statistcs about the viruses catched #
# by the Clam AntiVirus. #
# #
# For this script works, you need comment the option "LogVerbose" and #
# uncomment the option "LogTime" in your clamd.conf file. #
# #
# REQUERIMENTS: ClamAV #
# Python #
# #
# After that, add a script call in the crontab, it may be something like: #
# 30 0 * * * root /usr/local/bin/virus_stat.py #
# and adjust the "LogFileMaxSize" parameter in the clamd.conf file to a size #
# that wont exceed it in one day. #
# #
# ATTENTION: Use it for your own risk. Don't responsabilize me for anything #
# wrong that could be happen. #
# #
# by Ronan Lucio #
################################################################################
from string import split
import posix
posix.system( "/bin/cp /var/log/clamd.log /var/log/clamd-log" )
posix.system( "/bin/cat /dev/null > /var/log/clamd.log" )
cArq1 = "/var/log/clamd-log"
cArq2 = "/var/log/virus_stat.log"
aVirus = {}
try:
oArq2 = open( cArq2 )
cRet = oArq2.readline()[:-1]
while cRet:
a,b = split( cRet )
aVirus[a] = b
cRet = oArq2.readline()[:-1]
oArq2.close()
except:
pass
oArq1 = open( cArq1 )
cRet = oArq1.readline()[:-1]
while cRet:
a = split( cRet )
cAno = a[4]
cMes = a[1]
cDia = a[2]
cVirNam = a[len(a)-2]
cVirFou = a[len(a)-1]
cString = "%s%s%s-%s" % (cAno, cMes, cDia, cVirNam)
if cVirFou == "FOUND":
if aVirus.has_key( cString ):
aVirus[cString] = int(aVirus[cString]) + 1
else:
aVirus[cString] = 1
cRet = oArq1.readline()[:-1]
oArq1.close()
lVirus = []
for i in aVirus.items():
lVirus.append( i[0]+" "+str(i[1]) )
lVirus.sort()
oArq2 = open( cArq2, "w" )
for i in lVirus:
oArq2.write( "%s\n" % i )
oArq2.close()
posix.unlink( cArq1 )
---------------------------------------------------------
---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
