visitors_0.7/0042755000175000017500000000000010412774745013257 5ustar antirezantirezvisitors_0.7/AUTHORS0100644000175000017500000000046510412774745014327 0ustar antirezantirezSalvatore Sanfilippo Other people contributing ideas or bug reports are listed in the Changelog file. Note that there are no contributors of source code, that's all written by Salvatore Sanfilippo (see the "HOW TO HELP" section of the README file to know why, I'm not happy about it). visitors_0.7/COPYING0100644000175000017500000004371510412774745014317 0ustar antirezantirez All the Software contained in this source distribution is Copyright(C) 2004,2005 Salvatore Sanfilippo. All Rights reserved. The file iis2apache.pl is Copyright(C) 2000 jwa@jammed.com The Software is released by the author under the following GPL version 2 license, except for the file named "aht.c" that is released under the license specified in the first comments of the C file itself. GNU GENERAL PUBLIC LICENSE Version 2, June 1991 Copyright (C) 1989, 1991 Free Software Foundation, Inc. 675 Mass Ave, Cambridge, MA 02139, USA Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. Preamble The licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change free software--to make sure the software is free for all its users. This General Public License applies to most of the Free Software Foundation's software and to any other program whose authors commit to using it. (Some other Free Software Foundation software is covered by the GNU Library General Public License instead.) You can apply it to your programs, too. When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs; and that you know you can do these things. To protect your rights, we need to make restrictions that forbid anyone to deny you these rights or to ask you to surrender the rights. These restrictions translate to certain responsibilities for you if you distribute copies of the software, or if you modify it. For example, if you distribute copies of such a program, whether gratis or for a fee, you must give the recipients all the rights that you have. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights. We protect your rights with two steps: (1) copyright the software, and (2) offer you this license which gives you legal permission to copy, distribute and/or modify the software. Also, for each author's protection and ours, we want to make certain that everyone understands that there is no warranty for this free software. If the software is modified by someone else and passed on, we want its recipients to know that what they have is not the original, so that any problems introduced by others will not reflect on the original authors' reputations. Finally, any free program is threatened constantly by software patents. We wish to avoid the danger that redistributors of a free program will individually obtain patent licenses, in effect making the program proprietary. To prevent this, we have made it clear that any patent must be licensed for everyone's free use or not licensed at all. The precise terms and conditions for copying, distribution and modification follow. GNU GENERAL PUBLIC LICENSE TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION 0. This License applies to any program or other work which contains a notice placed by the copyright holder saying it may be distributed under the terms of this General Public License. The "Program", below, refers to any such program or work, and a "work based on the Program" means either the Program or any derivative work under copyright law: that is to say, a work containing the Program or a portion of it, either verbatim or with modifications and/or translated into another language. (Hereinafter, translation is included without limitation in the term "modification".) Each licensee is addressed as "you". Activities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running the Program is not restricted, and the output from the Program is covered only if its contents constitute a work based on the Program (independent of having been made by running the Program). Whether that is true depends on what the Program does. 1. You may copy and distribute verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and give any other recipients of the Program a copy of this License along with the Program. You may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee. 2. You may modify your copy or copies of the Program or any portion of it, thus forming a work based on the Program, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions: a) You must cause the modified files to carry prominent notices stating that you changed the files and the date of any change. b) You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License. c) If the modified program normally reads commands interactively when run, you must cause it, when started running for such interactive use in the most ordinary way, to print or display an announcement including an appropriate copyright notice and a notice that there is no warranty (or else, saying that you provide a warranty) and that users may redistribute the program under these conditions, and telling the user how to view a copy of this License. (Exception: if the Program itself is interactive but does not normally print such an announcement, your work based on the Program is not required to print an announcement.) These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Program, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Program, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it. Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Program. In addition, mere aggregation of another work not based on the Program with the Program (or with a work based on the Program) on a volume of a storage or distribution medium does not bring the other work under the scope of this License. 3. You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following: a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, c) Accompany it with the information you received as to the offer to distribute corresponding source code. (This alternative is allowed only for noncommercial distribution and only if you received the program in object code or executable form with such an offer, in accord with Subsection b above.) The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable. However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable. If distribution of executable or object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place counts as distribution of the source code, even though third parties are not compelled to copy the source along with the object code. 4. You may not copy, modify, sublicense, or distribute the Program except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense or distribute the Program is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance. 5. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Program or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Program (or any work based on the Program), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Program or works based on it. 6. Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties to this License. 7. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Program at all. For example, if a patent license would not permit royalty-free redistribution of the Program by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Program. If any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply and the section as a whole is intended to apply in other circumstances. It is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system, which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice. This section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License. 8. If the distribution and/or use of the Program is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Program under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License. 9. The Free Software Foundation may publish revised and/or new versions of the General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. Each version is given a distinguishing version number. If the Program specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of this License, you may choose any version ever published by the Free Software Foundation. 10. If you wish to incorporate parts of the Program into other free programs whose distribution conditions are different, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally. NO WARRANTY 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. END OF TERMS AND CONDITIONS Appendix: How to Apply These Terms to Your New Programs If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms. To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively convey the exclusion of warranty; and each file should have at least the "copyright" line and a pointer to where the full notice is found. Copyright (C) 19yy This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. Also add information on how to contact you by electronic and paper mail. If the program is interactive, make it output a short notice like this when it starts in an interactive mode: Gnomovision version 69, Copyright (C) 19yy name of author Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. This is free software, and you are welcome to redistribute it under certain conditions; type `show c' for details. The hypothetical commands `show w' and `show c' should show the appropriate parts of the General Public License. Of course, the commands you use may be called something other than `show w' and `show c'; they could even be mouse-clicks or menu items--whatever suits your program. You should also get your employer (if you work as a programmer) or your school, if any, to sign a "copyright disclaimer" for the program, if necessary. Here is a sample; alter the names: Yoyodyne, Inc., hereby disclaims all copyright interest in the program `Gnomovision' (which makes passes at compilers) written by James Hacker. , 1 April 1989 Ty Coon, President of Vice This General Public License does not permit incorporating your program into proprietary programs. If your program is a subroutine library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Library General Public License instead of this License. visitors_0.7/Changelog0100644000175000017500000001766010412774745015076 0ustar antirezantirez-> Visitors 0.7 Released (30 March 2006) 30Mar2005 - Added screen resolution and color depth report (via Javascript) see the README file for more info. 12Dic2005 - Added --debug option for verbose errors. 17Nov2004 - Debian Bug#339594: default output is html, but the manpage says text. Fixed. Thanks to Rick Pasotto for reporting the bug. 15Nov2005 - --grep and --exclude options implemented. 13Nov2005 - --ignore-404 option, useful to ignore log lines about missing pages. When this option is turned on log lines with 404 errors are just used to generate the 404 errors report and not used for other reports. -> Visitors 0.61 Released (25 October 2005) 24Oct2005 - Versioning scheme changed, after 0.6 now there is 0.61 instead of 0.6a like it was in the past. 0.6a may look like an alpha release. 24Oct2005 - Ignore more bots other than bots from google when computing unique visitors stats. This makes unique visitors stats much more reliable, there are crawlers with 200 and more different IP addresses so the unique visitors algorithm does not help there. -> Visitors 0.6 Released (10 October 2005) 10Oct2005 - New report: Adsensed-pages. Like googled-pages but for the adsense crawler, that's supposted to be the one with Mediapartners-Google user agent. 10Oct2005 - Fixed a bug resulting in wrong googled-pages report. 04Oct2005 - Some formatting problem and a bug introduced in the 0.6 beta version fixed thanks to Simon Waters 03Oct2005 - Visitors's site finally contains a Japanese translation thanks to Takeshi ABE (tabe (at) fixedpoint (dot) jp). 02Oct2005 - Fixed the parsing code to detect the user agent string when no occurence of (...) string is present. This results in more accurate stats. 02Oct2005 - New feature: Referer spam filtering via blacklist.h 02Oct2005 - New report: google's "hl" human language. 17Sep2005 - Browsers list updated, Internet Explorer splitted into IE4, IE5 and IE6, detection of Firefox as a special case of Gecko based. 16Sep2005 - Fixed Debian Bug #312345, adding newline for every 'td' table element generated to create 2D maps. This makes simpler to send reports by email. Thanks to Simon Waters -> Visitors 0.5 Released 29Apr2005 - An unix manual page was added thanks to Romain Francoise that wrote it for Debian. 29Apr2005 - Most stats are now done by visits instead of by hits. 28Apr2005 - Changes to the referer algorithms to be a bit more immune to referer spamming. 28Apr2005 - Memory usage reduced of 50% with very minor speed penality. 28Apr2005 - Fixed an overflow resulting in negative percentages in reports. 07Dec2004 - Added .swf and .js extensions as 'images'. 03Oct2004 - Fixed a bug in url encoding routine. 02Oct2004 - Resolved a collision with the short option 'P' (Thx to Yvse Goerden for bug report). 02Oct2004 - Added options to ignore selected "special" nodes, for the grapvhiz graph generation. 02Oct2004 - Better graphviz graph generation, includes google, external link, no referers, percentages in arcs. 27Sep2004 - HTML is now the default output module 27Sep2004 - Highlight colors for weekend days changed (more visible). 27Sep2004 - Referers by age, in the report is now named "referers by first time" 25Sep2004 - New report: monthly visitors and monthly visitors from google. 24Sep2004 - New report: month-day bidimentional map. --> Visitors 0.4a Released agent. 22Sep2004 - Fixed a problem resulting from a change in Google's bot user --> Visitors 0.4 Released develop shell scripts. Thanks to David Siegal for the suggestion. file specified. It's more useful for system administrators that want to exit with error code '1' instead to continue and try to process the next log 15Sep2004 - On missing file or error in report generation Visitors will now 14Sep2004 - keyphrases in "google keyphrases" report are now links that will perform a search on google for the given keyphrase. Thanks to David Siegal for the idea. 13Sep2004 - Fixed a bug in the parser (vi_parse_line don't used to check if vi_parse_date() returned an error). Added a redundant sanity check related to this. Thanks to David Siegal for reporting the error and offending (currupted) log lines. 13Aug2004 - New report: pageviews per visit. 12Aug2004 - Added --time-delta option to the command line. It's useful if the web server is in a timezone but most visitors are accessing the site from a different timezone. Feature suggested by Philipp Droessler . 30Jul2004 - Keyphrases are now processed in a case-insensitive manner, spaces at the start and at the end of the keyphrases are now filtered. 30Jul2004 - Google Keyphrases report contains the number of google page for every keyphrase. 30Jul2004 - New report, 404 errors. 29Jul2004 - Google's cache accesses no longer reported as keyphrases. 29Jul2004 - Keyphrases and requested pages/files are now urldecoded in the report. 29Jul2004 - Now referers report shows two new items: internal link and google search engine. 31May2004 - Fixed makefile to respect environment vars thanks to Florent Thoumie --> Visitors 0.3a Released 27May2004 - Fixed a compilation problem with older versions of GCC 27May2004 - Fixed a bug in the plaintext output formatting --> Visitors 0.3 Released 23May2004 - the General Information section now includes the generation date. 23May2004 - New report, Browsers 22May2004 - New report, Operating Systems by hits. 22May2004 - Weekend dates highlighted in the html report. 22May2004 - Added ancors to reports to easily jump to the specified report. 22May2004 - Css modified. 22May2004 - Stream mode implemented, for incremental statistics almost in realtime. 22May2004 - Fixed compilation on SunOS (patch from Michel Gravey ) 22May2004 - New report, clients top level domains by hits. 22May2004 - Implemented a 'tail-mode' that emulates the unix "tail -f" command. The tail-mode handles file rotations. This new mode will be useful with the stream-mode still not implemented. 22May2004 - Dates are converted in time_t values at line-parsing stage, and converted back to strings only to create reports. After this change the gogoled and referers by age reports are sorted even by hour/minute/second and not only by date. This should also make it faster. 21May2004 - Fixed a bug with referers by age, on date format error don't stop the log processing now. 20May2004 - All the output functions modified to get a file descriptor as first argument instead to assume standard output. --> Visitors 0.2a Released 12May2004 - New report, referers by age. A new function generalize the report of url/date type. 12May2004 - 'print_keykey_method' modofied to get the number of the item. 12May2004 - Referers report does no longer include referers from google. 12May2004 - Added subtitles in reports to better explain how to read they. 11May2004 - 'print_numkey_method' modified to get the number of the item, so reports like referer, keyphrases have numbered items from "1)" to ")". 11May2004 - Credits text in html output modified. 11May2004 - New report, bidimentional weekdays/hours map. --> Visitors 0.2 Released 09May2004 - Too long lines are now truncated in the html report. 09May2004 - Fixed a bug in google's keyphrases processing. 09May2004 - Fixed a bug in the text output module bar printing. 09May2004 - Web trails max lines made configurable with --max-trails. 09May2004 - CSS files are now reported under the "images and css" report. 08May2004 - Added support to output Graphviz graphs with web trails. 08May2004 - Multiple --prefix options are now accepted and processed. 08May2004 - Order of reports visualization changed. 08May2004 - New report added: visitors from google VS all the rest for every day. 07May2004 - Entries with "bad" dates are now put at the end of the "unique visitors for every day" report. 07May2004 - Fixed 'processed in N seconds' stderr output in case of file not found. (Salvatore Sanfilippo) --> Visitors 0.1 Released visitors_0.7/Makefile0100644000175000017500000000071010412774745014710 0ustar antirezantirez# Makefile for visitors # Copyright (C) 2004 Salvatore Sanfilippo # All Rights Reserved # Under the GPL license version 2 DEBUG?= -g CFLAGS?= -O2 -Wall -W CCOPT= $(CFLAGS) OBJ = visitors.o aht.o antigetopt.o tail.o PRGNAME = visitors all: visitors visitors.o: visitors.c blacklist.h visitors: $(OBJ) $(CC) -o $(PRGNAME) $(CCOPT) $(DEBUG) $(OBJ) .c.o: $(CC) -c $(CCOPT) $(DEBUG) $(COMPILE_TIME) $< clean: rm -rf $(PRGNAME) *.o visitors_0.7/NOTIFY0100644000175000017500000000052110412774745014203 0ustar antirezantirezThis is a list of email addresses and internet sites to notify when a new version of visitors is available: Freshmeat http://www.freshmeat.net Florent Thoumie FreeBSD port maintainer Romain Francoise Debian package maintainer Sven Wegener Gentoo portage visitors_0.7/README0100644000175000017500000000726210412774745014141 0ustar antirezantirezWELCOME TO VISITORS 0.7 ----------------------- Hello, this is Visitors, a fast and easy to use web log analyzer. For more usage information, documentation and examples please visit: http://www.hping.org/visitors or check the docs.html file in this directory for the reference documentation. HOW TO COMPILE -------------- Under UNIX systems just type: % make Under WIN32 you need MINGW and MSYS, then follow the above istructions. For compliation problems please write an email to with the exact problem, version of Visitors, environment, GCC used, and so on. HOW TO USE WITH IIS LOGS ------------------------ Use the iis2apache.pl perl script to do the conversion, like: cat yourIISLogFile.txt | perl iis2apache.pl > yourConvertedFile.txt Then run visitors against "yourConvertedFile.txt". There is an alternative way to convert logs using a program that does not require Perl, with Windows and Linux binaries. This program is called RConvLog and it's possible to download it at http://www.rebex.net/RConvLog/ HOW TO GET SCREEN RESOLUTION INFORMATION ---------------------------------------- Log files don't contain information about the screen resolution so in order to generate the screen resolution report Visitors needs that you add the following code in your home page, after the tag: Without this code the screen resolution report will not work. HOW TO HELP ----------- Unfortunately I can't accept source code written by external contributors without a "Copyright Assignment", because I'm not sure I'll take the GPL license in the future, instead I may switch to BSD, or even to create a commercial version of Visitors (very unlikely). Because I don't like the idea of "Copyright Assignment" at all I'll be happy to implement any useful feature in Visitors for you so: Please send suggestions and bug reports. Thank you. ABOUT THE GPL, AND WHY SOMETIMES IT DOES NOT WORK ------------------------------------------------- There is some kind of problem with the GPL and small projects, when you can expect an amount of help by external contributors that is so little that's not worth the "License Lock-In" problem. What I mean is that Visitors is under the GPL license, and I'm not sure I'll be happy with this license forever. For example I may want to change the license using the BSD in the future, it's worth to lost the ability to do it just to accept some patch? When it's a big project and it is very likely to get a lot of contribs all is ok, I start directly with the BSD license. An example of this is the "Jim Interpreter", an open source program I started to develop after Visitors itself (see http://jim.berlios.de). You get a lot of help, the project gets bigger/better, still if you want you can use the code for your commercial stuff (it's BSD), and everybody can do it. Also note that nor the GPL accepting patches, nor the BSD allow the open source developer to create software that is available in two flawours: one free, and one commercial. BSD allows this but everybody can create another commercial product based on the same code: not fair. GPL allows this if you don't accept patches, that's also not good given that after all the code contributed will stay anyway in the GPL product forever. This is why I don't accept patches for Visitors, and why I'm highly unhappy with this solution. If you have some idea or comment please feel free to send it to antirez (at) gmail (dot) org. THANKS TO ... ------------- Please see the ChangeLog file for credits. Enjoy, Salvatore Sanfilippo visitors_0.7/SECURITY0100644000175000017500000000134610412774745014450 0ustar antirezantirezSECURITY FILE This file will contain a list of bugs related to security problems found in visitors. Currently no bug of this kind was reported or found. VISITORS CODE QUALITY AND AUDITING Visitors is tested with big log files and the valgrind program before of every release to ensure that there aren't obvious memory violation problems with normal log files, and was written with care about security. POSSIBLE PROBLEMS Still it's a C program that does a lot of pointer math in order to be fast, and its work is to process untrusted input (what's written in log files is in part client-driven), this file is here to contain detailed information if this kind of bugs will be found in future. LIST OF SECURITY BUGS FOUND None for now. visitors_0.7/TODO0100644000175000017500000000372710412774745013753 0ustar antirezantirez- Ignore 404 errors in every report, but in the 404 errors. - Screen resolution: conver 32 colorDepth to 24. Set a cookie with expire time to 24 hours so that the screen resolution is checked only for new visitors and not for every pageview. - Good suggestions at http://www.karlnelson.net/weblog/000925.html - Compress the man page with gzip -9 for Debian policy - Glob-style matching in --prefix, like: --prefix *invece.org - Keyword trails: hping -> / hping3 -> /hping3.html packet MTU -> /docs.html ... - Enter pages - Best referer in every month+year. This may be done with a single hash table if the key is: month+year+referer, then sort it by hits, and get every pair of month+year one the first time (running the hash table form the higher hits to the lower ones). - Best keyphrase in every month+year. See "Best referer in every month+year" for implementation tips. - When the list of urls/referers/... are limited, a final entry "others" should sum all the non shown values. - Countries by IP addresses? http://www.maxmind.com/app/geoip_country - --period to limit the analysis to log entries matching the specified period. - Processing time in seconds with decimal part, like 5,663 seconds. After this is implemented, it may print the lines for second speed if the time spent is more than 2 seconds or so. win32: http://mail.gnu.org/archive/html/bug-gnu-chess/2004-01/msg00020.html - Page-specific referers - An option to specify an external CSS name to link inside the HTML instead of the inline CSS. - An option to specify the r/g/b values of the bidimentional maps - Exclude google crawler accesses from weekday-hour map report? - Modify parse_date() to cache the result. - Normal "Foobar by hits" statistics should show the percentage - Better formatting for the new reports browser/os/domain in the plaintext report. - Think about hashing the time as unix-time integer instead of string in order to reduce processing time and memory usage. visitors_0.7/aht.c0100644000175000017500000004550710412774745014205 0ustar antirezantirez/* An implementation of in-memory hash tables: * Copyright (c) 2000-2004 Salvatore Sanfilippo * * -- VERSION 2004.05.22 -- * * COPYRIGHT AND PERMISSION NOTICE * ------------------------------- * * Copyright (c) 2000 Salvatore Sanfilippo * Copyright (c) 2001 Salvatore Sanfilippo * Copyright (c) 2002 Salvatore Sanfilippo * Copyright (c) 2003 Salvatore Sanfilippo * Copyright (c) 2004 Salvatore Sanfilippo * * All rights reserved. * * Permission is hereby granted, free of charge, to any person obtaining a * copy of this software and associated documentation files (the * "Software"), to deal in the Software without restriction, including * without limitation the rights to use, copy, modify, merge, publish, * distribute, and/or sell copies of the Software, and to permit persons * to whom the Software is furnished to do so, provided that the above * copyright notice(s) and this permission notice appear in all copies of * the Software and that both the above copyright notice(s) and this * permission notice appear in supporting documentation. * * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS * OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT * OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR * HOLDERS INCLUDED IN THIS NOTICE BE LIABLE FOR ANY CLAIM, OR ANY SPECIAL * INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES WHATSOEVER RESULTING * FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, * NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. * * Except as contained in this notice, the name of a copyright holder * shall not be used in advertising or otherwise to promote the sale, use * or other dealings in this Software without prior written authorization * of the copyright holder. * * CHANGELOG * --------- * * 22May2004 - Fixed a but in ht_destroy(). Now after this call the * hashtable is really ready to be reused. Fixed also a memory leak * in the same function. Luckly this function is only called at exit * in many programs. * * OVERVIEW * -------- * * AHT is an implementation of a dictionary with support for * INSERT, DELETE and SEARCH operations. It uses the hash table * as base data structure to provide almost constant times for * the three operations. AHT also automatically care about the * size of the current key-values set increasing the hash table * as needed. * * DESIGN PRINCIPLE * ---------------- * * - AHT try to resist to attacker-induced worst-case behaviour * trought the randomization of the hash-function. This is * optional. * * - AHT take care of the hash table expansion when needed. * The hash table load ranges from 0 to 0.5, the hash table * size is a power of two. * * - A simple implementation. The collisions resolution used * is a simple linear probing, that takes advantage of * the modern CPU caches, the low hash table max load and * the use of a strong hash function provided with this library * (ht_strong_hash), should mitigate the primary clustering * enough. Experimental results shown that double hashing * was a performance lost with common key types in modern * CPUs. * * - Moderatly method oriented, it is possible to define the hash * function, key/value destructors, key compare function, for a * given hash table, but not with a per-element base. * * === WARNING === * = Before to use this library, think about the -fact- that the * = worst case is O(N). Like for the quick sort algorithm, it may * = be a bad idea to use this library in medical software, or other * = software for wich the worst case should be taken in account * = even if not likely to happen. * = Good alternatives are red-black trees, and other trees with * = a good worst-case behavior. * =============== * * TODO * ---- * * - Write the documentation * - ht_copy() to copy an element between hash tables * - ht_dup() to duplicate an entire hash table * - ht_merge() to add the content of one hash table to another * - disk operations, the ability to save an hashtable from the * memory to the disk and the reverse operation. * * Most of this features needs additional methods, like one * to copy an object, and should return an error if such methods * are not defined. * */ #include #include #include #include #include #include "aht.h" /* -------------------------- private prototypes ---------------------------- */ static int ht_expand_if_needed(struct hashtable *t); static unsigned int next_power(unsigned int size); static int ht_insert(struct hashtable *t, void *key, unsigned int *avail_index); /* The special ht_free_element pointer is used to mark * a freed element in the hash table (note that the elements * neven used are just NULL pointers) */ static struct ht_ele *ht_free_element = (void*) -1; /* -------------------------- hash functions -------------------------------- */ /* The djb hash function, that's under public domain */ u_int32_t djb_hash(unsigned char *buf, size_t len) { u_int32_t h = 5381; while(len--) h = (h + (h << 5)) ^ *buf++; return h; } u_int32_t djb_hashR(unsigned char *buf, size_t len) { u_int32_t h = 5381; buf += len-1; while(len--) h = (h + (h << 5)) ^ *buf--; return h; } /* Another trivial hash function */ #define ROT32R(x,n) (((x)>>n)|(x<<(32-n))) u_int32_t trivial_hash(unsigned char *buf, size_t len) { u_int32_t h = 0; while(len--) { h = h + *buf++; h = ROT32R(h, 3); } return h; } u_int32_t trivial_hashR(unsigned char *buf, size_t len) { u_int32_t h = 0; buf += len-1; while(len--) { h = h + *buf--; h = ROT32R(h, 3); } return h; } /* A strong hash function that should be the default with this * hashtable implementation. Our hash tables does not support * double hashing for design: the idea is to avoid double * hashing and use a bit slower but very strong hash function like * this. This should provide quite good performances with * all the kinds of keys if you take the default max load of 50%. * * For more information see: http://burtleburtle.net/bob/hash/evahash.html */ /* The mixing step */ #define mix(a,b,c) \ { \ a=a-b; a=a-c; a=a^(c>>13); \ b=b-c; b=b-a; b=b^(a<<8); \ c=c-a; c=c-b; c=c^(b>>13); \ a=a-b; a=a-c; a=a^(c>>12); \ b=b-c; b=b-a; b=b^(a<<16); \ c=c-a; c=c-b; c=c^(b>>5); \ a=a-b; a=a-c; a=a^(c>>3); \ b=b-c; b=b-a; b=b^(a<<10); \ c=c-a; c=c-b; c=c^(b>>15); \ } /* The whole new hash function */ u_int32_t __ht_strong_hash(u_int8_t *k, u_int32_t length, u_int32_t initval) { u_int32_t a,b,c; /* the internal state */ u_int32_t len; /* how many key bytes still need mixing */ /* Set up the internal state */ len = length; a = b = 0x9e3779b9; /* the golden ratio; an arbitrary value */ c = initval; /* variable initialization of internal state */ /*---------------------------------------- handle most of the key */ while (len >= 12) { a=a+(k[0]+((u_int32_t)k[1]<<8)+((u_int32_t)k[2]<<16)+ ((u_int32_t)k[3]<<24)); b=b+(k[4]+((u_int32_t)k[5]<<8)+((u_int32_t)k[6]<<16)+ ((u_int32_t)k[7]<<24)); c=c+(k[8]+((u_int32_t)k[9]<<8)+((u_int32_t)k[10]<<16)+ ((u_int32_t)k[11]<<24)); mix(a,b,c); k = k+12; len = len-12; } /*------------------------------------- handle the last 11 bytes */ c = c+length; switch(len) /* all the case statements fall through */ { case 11: c=c+((u_int32_t)k[10]<<24); case 10: c=c+((u_int32_t)k[9]<<16); case 9 : c=c+((u_int32_t)k[8]<<8); /* the first byte of c is reserved for the length */ case 8 : b=b+((u_int32_t)k[7]<<24); case 7 : b=b+((u_int32_t)k[6]<<16); case 6 : b=b+((u_int32_t)k[5]<<8); case 5 : b=b+k[4]; case 4 : a=a+((u_int32_t)k[3]<<24); case 3 : a=a+((u_int32_t)k[2]<<16); case 2 : a=a+((u_int32_t)k[1]<<8); case 1 : a=a+k[0]; /* case 0: nothing left to add */ } mix(a,b,c); /*-------------------------------------------- report the result */ return c; } /* ----------------------------- API implementation ------------------------- */ /* reset an hashtable already initialized with ht_init(). * NOTE: This function should only called by ht_destroy(). */ static void ht_reset(struct hashtable *t) { t->table = NULL; t->size = 0; t->sizemask = 0; t->used = 0; t->collisions = 0; } /* Initialize the hash table */ int ht_init(struct hashtable *t) { ht_reset(t); t->hashf = ht_hash_pointer; t->key_destructor = ht_no_destructor; t->val_destructor = ht_no_destructor; t->key_compare = ht_compare_ptr; return HT_OK; } /* Resize the table to the minimal size that contains all the elements */ int ht_resize(struct hashtable *t) { int minimal = (t->used * 2)+1; if (minimal < HT_INITIAL_SIZE) minimal = HT_INITIAL_SIZE; return ht_expand(t, minimal); } /* Move an element accross hash tables */ int ht_move(struct hashtable *orig, struct hashtable *dest, unsigned int index) { int ret; unsigned int new_index; /* If the element isn't in the table ht_search will store * the index of the free ht_ele in the integer pointer by *index */ ret = ht_insert(dest, orig->table[index]->key, &new_index); if (ret != HT_OK) return ret; /* Move the element */ dest->table[new_index] = orig->table[index]; orig->table[index] = ht_free_element; orig->used--; dest->used++; return HT_OK; } /* Expand or create the hashtable */ int ht_expand(struct hashtable *t, size_t size) { struct hashtable n; /* the new hashtable */ unsigned int realsize = next_power(size), i; /* the size is invalid if it is smaller than the number of * elements already inside the hashtable */ if (t->used >= size) return HT_INVALID; ht_init(&n); n.size = realsize; n.sizemask = realsize-1; n.table = malloc(realsize*sizeof(struct ht_ele*)); if (n.table == NULL) return HT_NOMEM; /* Copy methods */ n.hashf = t->hashf; n.key_destructor = t->key_destructor; n.val_destructor = t->val_destructor; n.key_compare= t->key_compare; /* Initialize all the pointers to NULL */ memset(n.table, 0, realsize*sizeof(struct ht_ele*)); /* Copy all the elements from the old to the new table: * note that if the old hash table is empty t->size is zero, * so ht_expand() acts like an ht_create() */ n.used = t->used; for (i = 0; i < t->size && t->used > 0; i++) { if (t->table[i] != NULL && t->table[i] != ht_free_element) { u_int32_t h; /* Get the new element index: note that we * know that there aren't freed elements in 'n' */ h = n.hashf(t->table[i]->key) & n.sizemask; if (n.table[h]) { n.collisions++; while(1) { h = (h+1) & n.sizemask; if (!n.table[h]) break; n.collisions++; } } /* Move the element */ n.table[h] = t->table[i]; t->used--; } } assert(t->used == 0); free(t->table); /* Remap the new hashtable in the old */ *t = n; return HT_OK; } /* Add an element, discarding the old if the key already exists */ int ht_replace(struct hashtable *t, void *key, void *data) { int ret; unsigned int index; /* Try to add the element */ ret = ht_add(t, key, data); if (ret == HT_OK || ret != HT_BUSY) return ret; /* It already exists, get the index */ ret = ht_search(t, key, &index); assert(ret == HT_FOUND); /* Remove the old */ ret = ht_free(t, index); assert(ret == HT_OK); /* And add the new */ return ht_add(t, key, data); } /* Add an element to the target hash table */ int ht_add(struct hashtable *t, void *key, void *data) { int ret; unsigned int index; /* If the element isn't in the table ht_insert() will store * the index of the free ht_ele in the integer pointer by *index */ ret = ht_insert(t, key, &index); if (ret != HT_OK) return ret; /* Allocates the memory and stores key */ if ((t->table[index] = malloc(sizeof(struct ht_ele))) == NULL) return HT_NOMEM; /* Store the pointers */ t->table[index]->key = key; t->table[index]->data = data; t->used++; return HT_OK; } /* search and remove an element */ int ht_rm(struct hashtable *t, void *key) { int ret; unsigned int index; if ((ret = ht_search(t, key, &index)) != HT_FOUND) return ret; return ht_free(t, index); } /* Destroy an entire hash table */ int ht_destroy(struct hashtable *t) { unsigned int i; /* Free all the elements */ for (i = 0; i < t->size && t->used > 0; i++) { if (t->table[i] != NULL && t->table[i] != ht_free_element) { if (t->key_destructor) t->key_destructor(t->table[i]->key); if (t->val_destructor) t->val_destructor(t->table[i]->data); free(t->table[i]); t->used--; } } /* Free the table and the allocated cache structure */ free(t->table); /* Re-initialize the table */ ht_reset(t); return HT_OK; /* Actually ht_destroy never fails */ } /* Free an element in the hash table */ int ht_free(struct hashtable *t, unsigned int index) { if (index >= t->size) return HT_IOVERFLOW; /* Index overflow */ /* ht_free() calls against non-existent elements are ignored */ if (t->table[index] != NULL && t->table[index] != ht_free_element) { /* release the key */ if (t->key_destructor) t->key_destructor(t->table[index]->key); /* release the value */ if (t->val_destructor) t->val_destructor(t->table[index]->data); /* free the element structure */ free(t->table[index]); /* mark the element as freed */ t->table[index] = ht_free_element; t->used--; } return HT_OK; } /* Search the element with the given key */ int ht_search(struct hashtable *t, void *key, unsigned int *found_index) { int ret; u_int32_t h; /* Expand the hashtable if needed */ if (t->size == 0) { if ((ret = ht_expand_if_needed(t)) != HT_OK) return ret; } /* Try using the first hash functions */ h = t->hashf(key) & t->sizemask; /* this handles the removed elements */ if (!t->table[h]) return HT_NOTFOUND; if (t->table[h] != ht_free_element && t->key_compare(key, t->table[h]->key)) { *found_index = h; return HT_FOUND; } while(1) { h = (h+1) & t->sizemask; /* this handles the removed elements */ if (t->table[h] == ht_free_element) continue; if (!t->table[h]) return HT_NOTFOUND; if (t->key_compare(key, t->table[h]->key)) { *found_index = h; return HT_FOUND; } } } /* This function is used to run the entire hash table, * it returns: * 1 if the element with the given index is valid * 0 if the element with the given index is empty or marked free * -1 if the element if out of the range */ int ht_get_byindex(struct hashtable *t, unsigned int index) { if (index >= t->size) return -1; if (t->table[index] == NULL || t->table[index] == ht_free_element) return 0; return 1; } /* Returns the hash table as an array of paris of key/value void* pointers. * The array is allocated with malloc() and should be freed when no * longer useful. The key and value pointers should not be freed or * altered in any way, they will be handled by the hash table structure. * * This function is mainly useful to sort the hashtable's content * without to alter the hashtable itself. * * Returns NULL on out of memory. */ void **ht_get_array(struct hashtable *t) { int used = ht_used(t); void **table, **tptr; long idx; if ((table = (void**) malloc(sizeof(void*)*(used*2))) == NULL) return NULL; tptr = table; for (idx = 0; ;idx++) { int type = ht_get_byindex(t, idx); if (type == -1) break; if (type == 0) continue; *tptr++ = ht_key(t, idx); *tptr++ = ht_value(t, idx); } return table; } /* ------------------------- private functions ------------------------------ */ /* Expand the hash table if needed */ static int ht_expand_if_needed(struct hashtable *t) { /* If the hash table is empty expand it to the intial size, * if the table is half-full redobule its size. */ if (t->size == 0) return ht_expand(t, HT_INITIAL_SIZE); if (t->size <= t->used*2) return ht_expand(t, t->size * 2); return HT_OK; } /* Our hash table capability is a power of two */ static unsigned int next_power(unsigned int size) { unsigned int i = 256; if (size >= 2147483648U) return 2147483648U; while(1) { if (i >= size) return i; i *= 2; } } /* the insert function to add elements out of ht expansion */ static int ht_insert(struct hashtable *t, void *key, unsigned int *avail_index) { int ret; u_int32_t h; /* Expand the hashtable if needed */ if ((ret = ht_expand_if_needed(t)) != HT_OK) return ret; /* Try using the first hash functions */ h = t->hashf(key) & t->sizemask; /* this handles the removed elements */ if (!t->table[h] || t->table[h] == ht_free_element) { *avail_index = h; return HT_OK; } t->collisions++; if (t->key_compare(key, t->table[h]->key)) return HT_BUSY; while(1) { h = (h+1) & t->sizemask; /* this handles the removed elements */ if (!t->table[h] || t->table[h] == ht_free_element) { *avail_index = h; return HT_OK; } t->collisions++; if (t->key_compare(key, t->table[h]->key)) return HT_BUSY; } } /* ------------------------- provided destructors --------------------------- */ /* destructor for heap allocated keys/values */ void ht_destructor_free(void *obj) { free(obj); } /* ------------------------- provided comparators --------------------------- */ /* default key_compare method */ int ht_compare_ptr(void *key1, void *key2) { return (key1 == key2); } /* key compare for nul-terminated strings */ int ht_compare_string(void *key1, void *key2) { return (strcmp(key1, key2) == 0) ? 1 : 0; } /* -------------------- hash functions for common data types --------------- */ /* We make this global to allow hash function randomization, * as security measure against attacker-induced worst case behaviuor. * * Note that being H_i the strong hash function with init value of i * and H_i' the same hash function with init value of i' than: * * if H_i(StringOne) is equal to H_i(CollidingStringTwo) * * it is NOT true that * * H_i'(StringOne) is equal to H_i''(CollidingStringTwo) */ static u_int32_t strong_hash_init_val = 0xF937A21; /* Set the secret initialization value. It should be set from * a secure PRNG like /dev/urandom at program initialization time */ void ht_set_strong_hash_init_val(u_int32_t secret) { strong_hash_init_val = secret; } /* __ht_strong_hash wrapper that mix a user-provided initval * with the global strong_hash_init_val. __ht_strong_hash is * even exported directly. */ u_int32_t ht_strong_hash(u_int8_t *k, u_int32_t length, u_int32_t initval) { return __ht_strong_hash(k, length, initval^strong_hash_init_val); } /* Hash function suitable for C strings and other data types using * a 0-byte as terminator */ u_int32_t ht_hash_string(void *key) { return __ht_strong_hash(key, strlen(key), strong_hash_init_val); } /* This one is to hash the value of the pointer itself. */ u_int32_t ht_hash_pointer(void *key) { return __ht_strong_hash((void*)&key, sizeof(void*), strong_hash_init_val); } visitors_0.7/aht.h0100644000175000017500000000635010412774745014203 0ustar antirezantirez/* An implementation of hash tables: * Copyright(C) 2000-2004 by Salvatore Sanfilippo * * This software is under the GNU GPL license */ #include #ifndef _AHT_H #define _AHT_H /* Fix to compile under WIN32/MINGW and SunOS */ #if defined(WIN32) || defined(__sun__) #ifndef u_int8_t #define u_int8_t unsigned char #define u_int16_t unsigned short #define u_int32_t unsigned int #endif #endif /* ------------------------------ exit codes -------------------------------- */ #define HT_OK 0 /* Success */ #define HT_FOUND 1 /* Key found */ #define HT_NOTFOUND 2 /* Key not found */ #define HT_BUSY 3 /* Key already exist */ #define HT_NOMEM 4 /* Out of memory */ #define HT_IOVERFLOW 5 /* Index overflow */ #define HT_INVALID 6 /* Invalid argument */ #define HT_INITIAL_SIZE 256 /* ----------------------- hash table structures -----------------------------*/ struct ht_ele { void *key; void *data; }; struct hashtable { struct ht_ele **table; unsigned int size; unsigned int sizemask; unsigned int used; unsigned int collisions; u_int32_t (*hashf)(void *key); int (*key_compare)(void *key1, void *key2); void (*key_destructor)(void *key); void (*val_destructor)(void *obj); }; /* ----------------------------- Prototypes ----------------------------------*/ int ht_init(struct hashtable *t); int ht_move(struct hashtable *orig, struct hashtable *dest, unsigned int index); int ht_expand(struct hashtable *t, size_t size); int ht_add(struct hashtable *t, void *key, void *data); int ht_replace(struct hashtable *t, void *key, void *data); int ht_rm(struct hashtable *t, void *key); int ht_destroy(struct hashtable *t); int ht_free(struct hashtable *t, unsigned int index); int ht_search(struct hashtable *t, void *key, unsigned int *found_index); int ht_get_byindex(struct hashtable *t, unsigned int index); int ht_resize(struct hashtable *t); void **ht_get_array(struct hashtable *t); /* provided destructors */ void ht_destructor_free(void *obj); #define ht_no_destructor NULL /* provided compare functions */ int ht_compare_ptr(void *key1, void *key2); int ht_compare_string(void *key1, void *key2); /* ------------------------ The hash functions ------------------------------ */ u_int32_t djb_hash(unsigned char *buf, size_t len); u_int32_t djb_hashR(unsigned char *buf, size_t len); u_int32_t trivial_hash(unsigned char *buf, size_t len); u_int32_t trivial_hashR(unsigned char *buf, size_t len); u_int32_t ht_strong_hash(u_int8_t *k, u_int32_t length, u_int32_t initval); u_int32_t __ht_strong_hash(u_int8_t *k, u_int32_t length, u_int32_t initval); /* ----------------- hash functions for common data types ------------------- */ u_int32_t ht_hash_string(void *key); u_int32_t ht_hash_pointer(void *key); /* ----------------------------- macros --------------------------------------*/ #define ht_set_hash(t,f) ((t)->hashf = (f)) #define ht_set_key_destructor(t,f) ((t)->key_destructor = (f)) #define ht_set_val_destructor(t,f) ((t)->val_destructor = (f)) #define ht_set_key_compare(t,f) ((t)->key_compare = (f)) #define ht_collisions(t) ((t)->collisions) #define ht_size(t) ((t)->size) #define ht_used(t) ((t)->used) #define ht_key(t, i) ((t)->table[(i)]->key) #define ht_value(t, i) ((t)->table[(i)]->data) #endif /* _AHT_H */ visitors_0.7/antigetopt.c0100644000175000017500000001534410412774745015603 0ustar antirezantirez/* antigetopt -- a getopt replacement * Copyright(C) 2001 Salvatore Sanfilippo * This software is released under the GPL license * see the COPYING file for more information */ /* $Id: antigetopt.c,v 1.1.1.1 2005/10/02 22:44:47 antirez Exp $ */ /* TODO: * argument list sanity check */ #include #include #include #include "antigetopt.h" /* global vars */ char *ago_optarg = NULL; char *ago_optname = NULL; char ago_optchar = '\0'; /* static vars */ static struct ago_exception { int (*tester)(void); char *msg; } ago_exceptions[3] = { { NULL, NULL }, { NULL, NULL }, { NULL, NULL } }; static int ago_exception_bits[] = { AGO_EXCEPT0, AGO_EXCEPT1, AGO_EXCEPT2 }; /* static functions */ static struct ago_optlist *ago_lookup(struct ago_optlist *list, char *arg, int *islong, int *amb); static int strinitcmp(char *a, char *b); /*----------------------------- implementation ------------------------------ */ int antigetopt(int argc, char **argv, struct ago_optlist *list) { static char **save_argv = NULL; static char *chain = NULL; static int endoptions = 0; struct ago_optlist *opt; int islong; argc = argc; /* avoid a warning */ /* Reset */ if (argv == NULL) { save_argv = NULL; chain = NULL; endoptions = 0; return AGO_RESET; } else { if (save_argv == NULL) { save_argv = argv+1; /* skips the argv[0] */ /* XXX: argument list sanity check */ } } chain_start: if (chain) { if (*chain == '\0') chain = NULL; else { if ((opt = ago_lookup(list, chain, &islong, NULL)) == NULL) return AGO_UNKNOWN; if (!(opt->ao_flags & AGO_NOARG)) { /* the if expression maybe false if the * argument is optional */ if (chain[1] == '\0' && *save_argv) ago_optarg = *save_argv++; /* while it is mandatory for the NEEDARG type */ else if (opt->ao_flags & AGO_NEEDARG) return AGO_REQARG; } chain++; return opt->ao_id; } } argv = save_argv; /* handle the "--" special option */ if (*argv && strcmp(*argv, "--") == 0) { endoptions = 1; argv++; save_argv++; } while(*argv) { /* The option must start with '-' */ if (!endoptions && argv[0][0] == '-' && argv[0][1] != '\0') { int amb; /* note: ago_lookup also sets ago_optname */ if ((opt = ago_lookup(list, argv[0], &islong, &amb)) == NULL) return amb ? AGO_AMBIG : AGO_UNKNOWN; /* handle the collapsed short options */ if (!islong && argv[0][2] != '\0') { chain = argv[0]+1; save_argv++; goto chain_start; } /* if the option require or may have an argument */ ago_optarg = NULL; /* If the argument is needed we get the next argv[] * element without care about what it contains */ if (opt->ao_flags & AGO_NEEDARG) { if (argv[1] == NULL) return AGO_REQARG; ago_optarg = argv[1]; argv++; } /* If the argument is optional we only recognize it * as argument if it does not starts with '-' */ else if (opt->ao_flags & AGO_OPTARG) { if (argv[1] && argv[1][0] != '-') { ago_optarg = argv[1]; argv++; } } save_argv = argv+1; return opt->ao_id; } else { save_argv = argv+1; ago_optarg = argv[0]; ago_optchar = '\0'; ago_optname = NULL; return AGO_ALONE; } } return AGO_EOF; } #define UNK_SHORT_ERRSTRING "invalid option -- %c\n" #define UNK_LONG_ERRSTRING "unrecognized option `--%s'\n" #define ARG_SHORT_ERRSTRING "option requires an argument -- %c\n" #define ARG_LONG_ERRSTRING "option `--%s' requires an argument\n" #define AMB_ERRSTRING "option `--%s' is ambiguos\n" #define IERR_ERRSTRING "internal error. ago_gnu_error() called with " \ "a bad error code (%d)\n" void ago_gnu_error(char *pname, int error) { if (pname) fprintf(stderr, "%s: ", pname); switch(error) { case AGO_UNKNOWN: if (ago_optname) fprintf(stderr, UNK_LONG_ERRSTRING, ago_optname); else fprintf(stderr, UNK_SHORT_ERRSTRING, ago_optchar); break; case AGO_REQARG: if (ago_optname) fprintf(stderr, ARG_LONG_ERRSTRING, ago_optname); else fprintf(stderr, ARG_SHORT_ERRSTRING, ago_optchar); break; case AGO_AMBIG: fprintf(stderr, AMB_ERRSTRING, ago_optname); break; default: fprintf(stderr, IERR_ERRSTRING, error); break; } } int ago_set_exception(int except_nr, int (*tester)(void), char *msg) { if (tester == NULL || msg == NULL || except_nr < 0 || except_nr >= 3) return -1; ago_exceptions[except_nr].tester = tester; ago_exceptions[except_nr].msg = msg; return 0; } /*-------------------------- static functions ------------------------------- */ struct ago_optlist *ago_lookup(struct ago_optlist *list, char *arg, int *islong, int *amb) { int i; /* ago_lookup can be receive as `arg' a pointer to a * long argument, like --option, a pointer to a short * argument like -O, or just a pointer to a char sequence * in the case of collapsed short arguments like -abcde. */ /* Clear the 'ambiguos' flag, used to report the caller * an ambiguos option abbreviation error */ if (amb) *amb = 0; if (*arg == '-') /* skips the first - if any */ arg++; switch(*arg) { case '\0': return NULL; case '-': *islong = 1; arg++; /* skip the last - */ break; default: *islong = 0; break; } /* search the argument in the list */ if (*islong) { int retval; struct ago_optlist *last = NULL; while(!(list->ao_flags & AGO_ENDOFLIST)) { ago_optname = arg; ago_optchar = '\0'; if ((retval = strinitcmp(arg, list->ao_long)) != 0) { switch(retval) { case 1: if (last) { if (amb) *amb = 1; return NULL; } last = list; break; case 2: goto ok; } } list++; } if (last) { ago_optname = last->ao_long; list = last; goto ok; } } else { ago_optchar = *arg; ago_optname = NULL; while(!(list->ao_flags & AGO_ENDOFLIST)) { if (*arg == list->ao_short) goto ok; list++; } } return NULL; ok: /* handle the exceptions if any */ for (i = 0; i < 3; i++) { if ((list->ao_flags & ago_exception_bits[i]) && ago_exceptions[i].tester) { if (ago_exceptions[i].tester()) { if (ago_optname) { fprintf(stderr, "%s `--%s'\n", ago_exceptions[i].msg, ago_optname); } else { fprintf(stderr, "%s `-%c'\n", ago_exceptions[i].msg, ago_optchar); } exit(1); } } } return list; } /* Given two strings this function returns: * 1, if the strings are the same for the len of the first string (abc, abcde) * 2, if the strings are exactly the same: (abcd, abcd) * otherwise zero is returned (abcde, abcd) ... (djf, 293492) */ int strinitcmp(char *a, char *b) { if (!a || !b) return 0; while (*a && *b) { if (*a != *b) return 0; a++; b++; } if (*a) return 0; if (*a == *b) return 2; return 1; } visitors_0.7/antigetopt.h0100644000175000017500000000177610412774745015614 0ustar antirezantirez#ifndef __ANTIGETOPT_H #define __ANTIGETOPT_H /* special return codes */ enum { AGO_EOF=4000, AGO_ALONE, AGO_UNKNOWN, AGO_REQARG, AGO_RESET, AGO_AMBIG }; /* option flags */ #define AGO_NOARG (1<<0) /* no argument */ #define AGO_NEEDARG (1<<1) /* required argument */ #define AGO_OPTARG (1<<2) /* optional argument */ #define AGO_EXCEPT0 (1<<3) /* exception #0 */ #define AGO_EXCEPT1 (1<<4) /* exception #1 */ #define AGO_EXCEPT2 (1<<5) /* exception #3 */ #define AGO_ENDOFLIST (1<<15) /* end of argument list marker */ /* option list null term */ #define AGO_LIST_TERM {'\0',NULL,0,AGO_ENDOFLIST} /* The structure that defines an argument */ struct ago_optlist { char ao_short; char *ao_long; int ao_id; int ao_flags; }; extern char *ago_optarg; extern char *ago_optname; extern char ago_optchar; int antigetopt(int argc, char **argv, struct ago_optlist *list); void ago_gnu_error(char *pname, int error); int ago_set_exception(int except_nr, int (*tester)(void), char *msg); #endif /* __ANTIGETOPT_H */ visitors_0.7/blacklist.h0100644000175000017500000020244010412774745015375 0ustar antirezantirez/* blacklist.h -- Part of the Visitors Web Log Analyzer * Copyright (C) 2005 Salvatore Sanfilippo * * NOTE: * * This fail was obtained as a modification of the * MT-Blacklist Master Copy, see * http://www.jayallen.org/comment_spam/blacklist.txt * * It is modified for visitors in order to make regexps * simpler direct matches that can be performed with strstr() * C lib function. */ #define VI_BLACKLIST_LEN (sizeof(vi_blacklist)/sizeof(char*)) static char *vi_blacklist[] = { "lsotr", "lostr", "blowjob", "enlargement", "sonneries", "levitra", "lolita", "phentermine", "viagra", "zyban", "valtex", "xenical", "adipex", "meridia", "netfirms", "apartment", "milf", "hunter", "moms", "fucking", "casino", "prozac", "zoloft", "xanax", "valium", "hydrocodone", "vicodin", "paxil", "vioxx", "ragazze", "ultram", "tenuate", "tramadol", "pheromones", "phendimetrazine", "ionamin", "ortho", "tricyclen", "retin", "valtrex", "zyrtec", "ambien", "flonase", "allegra", "didrex", "renova", "bontril", "nexium", "-4-you.info", "-4u.info", "-mobile-phones.org", "-site.info", ".gb.com", ".lycos.de", ".static.net", "-casino.com", "-poker.com", "-porn.com" "01-beltonen.com", "01-klingeltoene.at", "01-klingeltoene.de", "01-loghi.com", "01-logo.com", "01-logot.com", "01-logotyper.com", "01-melodia.com", "01-melodias.com", "01-ringetone.com", "01-ringsignaler.com", "01-ringtone.com", "01-ringtones.us", "01-soittoaanet.com", "01-suonerie.com", "01-toque.com", "01ringtones.co.uk", "0adult-cartoon.com", "0adult-manga.com", "0cartoon-porn.com", "0cartoon-sex.com", "0cartoon.com", "0casino-online.com", "0casinoonline.com", "0catch.com", "0free-hentai.com", "0freehentai.com", "0hentai-anime.com", "0hentai-manga.com", "0hentaimanga.com", "0livesex.com", "0manga-porno.com", "0manga-sesso.com", "0manga.com", "0sesso-amatoriale.com", "0sesso-orale.biz", "0sesso.biz", "0sesso.us", "0sessoanale.com", "0sessogratis.us", "0sex-toons.com", "0sfondi-desktop.com", "0sfondi.com", "0suonerie.com", "0tatuaggi.com", "0toons.com", "0video-porno.com", "0xxx-cartoon.com", "1-bignaturals.com", "1-cumfiesta.com", "1-klingeltone.com", "1-online-poker.us", "1-poker-games.biz", "1-welivetogether.com", "1-wholesale-distributor.com", "100-sex.com", "100free.com", "100hgh.com", "101pills.com", "108bikes.com", "123-home-improvement-equity-loans.com", "123-sign-making-equipment-and-supplies.com", "123onlinepoker.com", "123sessogratis.com", "125mb.com", "15668.com", "16pp.com", "1a1merchantaccounts.com", "1asphost.com", "1concerttickets.com", "1footballtickets.com", "1freespot.com", "1on8.co.uk", "1on8.com", "1st-advantage-credit-repair.com", "1st-auto-insurance-4u.com", "1st-host.org", "1st-payday-loans.net", "1st-phonecard.com", "1st-poker-online.com", "1st-printer-ink-cartridge.com", "1st-shemale-sex.com", "1stincomeracing.co.uk", "1stindustrialdirectory.com", "1stlookcd.com", "1xp6z.com", "20fr.com", "216.130.167.230", "24-hour-fitness-online.com", "247-rx.net", "2ndmortgageinterestrates.com", "2teens.net", "2twinks.com", "2y.net", "2zj.cn", "3-day-diet-plan.com", "321cigarettes.com", "333-poker.com", "3333.ws", "365jp.com", "38ha.com", "3host.com", "3sixtyfour.com", "3yaoi.com", "404host.com", "404servers.com", "41b.net", "42tower.ws", "444-poker.com", "4hs8.com", "4mg.com", "4result.net", "4u-topshelfpussy.com", "4womenoftheworld.com", "51.net", "51asa.com", "555-poker.com", "5amateurs.com", "65.217.108.182", "666-gambling.com", "69.61.11.163", "6p.org.uk", "6x.to", "7host.com", "7p.org.uk", "7yardsweb.com", "888-online-poker.com", "888cas.com", "888jack.com", "88aabb.com", "8bit.co.uk", "8gold.com", "8k.com", "8yardsweb.com", "911easymoney.com", "911pills.info", "989888.com", "9p.org.uk", "a--e.com", "a-1-versicherungsvergleich.de", "a-pics.net", "a-purfectdream-expression.com", "a-stories.com", "a1-mortgage-finder.com", "a1cellphoneaccessories.info", "a1digitalcameras.info", "a1metalbuildings.info", "a1steelbuildings.info", "a1timemanagement.info", "abc3x.com", "abnehmen-ganz-sicher.com", "abocams.de", "aboutgrouphomes.com", "abymetro.org.uk", "academyofmusic.us", "acceptcreditcardsonlineinternetmerchantaccountservices.com", "acceptcreditcardsrealtime.com", "accompagnatrici.cc", "achtung.hopto.org", "acornfm.com", "acornwebdesign.co.uk", "acrs.us", "activerx.com", "acyclovir.net", "addictinggames.com", "aducasher.spb.ru", "adult-dvd-dot.com", "adult-dvds-dot.com", "adult-free-webcams.com", "adult-friend.info", "adult-games.name", "adult-manga.org", "adult-porno.us", "adultfreehosting.com", "adultfriendfinder.com", "adultfriendfindernow.com", "adultfriendfindersite.com", "adultfriendsite.com", "adulthostpro.com", "adultlingerieuk.com", "adultnonstop.com", "adultporncentral.net", "adultserviceproviders.com", "adultshare.com", "advantage-quotes.com", "aektschen.de", "aesthetics.co.il", "affilino.net", "afreeserver.com", "ahbabe.com", "aimite.com", "airfare-links.net", "airshow-china.com.cn", "alawna.blogspot.com", "all-calmortgage.com", "all-debt-consolidation.org", "all-fioricet.com", "all-gay-porn.us", "all-poker-online", "all-we-live-together.com", "allago.de", "allfind.us", "allinsurancetype.com", "allmagic.ru", "alloha.info", "allohaweb.com", "allthediets.com", "allthroating.com", "almacenpc.com", "alphacarolinas.org", "alright.com.ru", "alumnicards.com", "amateur-lesbian.us", "amateur-movie.us", "amateur-naked.us", "amateur-porn-gallery.com", "amateur-porno.us", "amateur-site.us", "amateur-thumbnail.com", "amateur-thumbs.net", "amateurjerkoff.org", "amateurs-xxx.us", "amateurs.r00m.com", "amateursuite.com", "amazing-satellite-tv-deals.info", "americacashfast.com", "american-single-dating.com", "americancdduplication.com", "americanpaydayloans.net", "americastgp.com", "amoxicillin-online.net", "anal-sex-pictures.us", "analloverz.com", "andyedf.de", "angenehmen-aufenthalt.de", "animal-fuck.org", "animal-porn.ws", "animalsex-movies-archive.com", "animalsex-pics-gallery.com", "anime-adult.us", "anime-hentai-porn.com", "anime-manga.us", "anime-porn-sex-xxx.com", "anime-porn.name", "anime-sex-cartoon-porn.com", "annunci-coppie.net", "annunci-erotici.net", "annunci-erotici.org", "annunci-personali.org", "annunci-sesso.org", "annunci-sesso.us", "annuncisesso.us", "anonsi.com", "anonymous-blogger.com", "ansar-u-deen.org", "anti-exploit.com", "anticlick.com.ru", "anuntisinmobiliaria.com", "anxietydisorders.biz", "anylight4u.com", "anything4health.com", "anzwers.org", "aol-com.us", "ap8.com", "apecceosummit2003.com", "apollopatch.com", "apornhost.com", "apply-to-green-card.org", "appollo.org", "approval-loan.com", "aquari.ru", "aquatyca.net", "arcsecurity.co.uk", "area-code-npa-nxx.com", "argendrom.com", "armor2net.com", "aromacc.com", "artsculpture.org", "aseman.weblogs.us", "asian-girls-porn-sex.com", "asian-girls.name", "asian-nude.blogspot.com", "asian-sex-woman.com", "asianbum.com", "ass-picture.us", "assserver.com", "at-capstone.com", "atkins-diet-center.com", "atkinsexpert.com", "atkpremium.net", "atkpremium.org", "atlanta2000.org", "atlas-pharmacy.com", "auctionmoneymakers.com", "auktions-uebersicht.de", "australia-online-travel.com", "austria-travels.info", "auto-insurance-links.net", "auto-loans-usa.biz", "autodetailproducts.com", "autodirektversicherung.com", "autofinanzierung-autokredit.de", "autofinanzierung-zum-festzins.de", "autohandelsmarktplatz.de", "autokredit-autofinanzierung.de", "autokredit-tipp.de", "automotive.com", "autumn-jade.com", "avon-one.com", "azian.org", "b-witchedcentral.co.uk", "ba2000.com", "babes-d.com", "babes-plus.com", "baby-perfekt.de", "babymarktplatz-aktiv.de", "back-room-facials.angelcities.com", "background-check.info", "backroom-facials.150m.com", "backseatbangers", "bad-movies.net", "bad-passion.com", "bahraichfun.com", "bali-dewadewi-tours.com", "bali-hotels.co.uk", "balidiscovery.org", "balivillas.net", "balltaas.com", "banialoba3w.150m.com", "banned-pics.com", "bannedhome.com", "barcodes.cn", "bare.org", "barely-legal-teenb.com", "barely-legald.com", "barelylegalgirlsex.com", "bargainfindsonebay.com", "bargeld-tipp.de", "basi-musicali.com", "basketball--betting.net", "bast3.ru", "batukaru.", "bbwclips.com", "bccinet.org", "bdsm-story.blogspot.com", "beastiality-animal-sex-stories.com", "beastiality-stories.net", "beastsex-movies.com", "beauty-farm.net", "bedding-etc.com", "belinking.com", "belle-donne.biz", "belle-ragazze.net", "belle-ragazze.org", "belleragazze.biz", "belleragazze.org", "bellissime-donne.com", "bellissime-donne.net", "bellissimedonne.com", "bellissimedonne.org", "beltonen-logos-spel.com", "benessere.us", "berwickfoundation.org", "best-buy-cialis.com", "best-cell-phone-batteries.info", "best-cialis-source.com", "best-deals-blackjack.info", "best-deals-casino.info", "best-deals-cheap-airline-tickets.info", "best-deals-diet.info", "best-deals-flowers.info", "best-deals-hotels.info", "best-deals-online-gambling.info", "best-deals-online-poker.info", "best-deals-poker.info", "best-deals-roulette.info", "best-deals-weight-loss.info", "best-e-site.com", "best-gambling.biz", "best-high-speed-internet.com", "best-internet-bingo.com", "best-pharmacy.us", "best-result-fast.com", "bestasianteens.com", "bestdims.com", "bestdvdclubs.com", "bestgamblinghouseonline.com", "besthandever.com", "bestiality-pics.org", "bestialitylinks.org", "bestits.net", "bestlowmortgagerates", "bestonline-medication.com", "bestonline-medication.net", "bestonline-shopping.com", "bestpornhost.com", "bet-on-horseracing.com", "beverlyhillspimpandhos.com", "beverlyhillspimpsandhos.com", "biexperience.org", "big-black-butts.net", "big-breast-success.com", "big-hooters.net", "big-natural-boobs.us", "big-naturals-4u.com", "big-rant.com", "bigbras-club.com", "bigmag.com.ua", "bigmoms.com", "bigtitchaz.com", "bigyonet.com", "bildmitteilung.us", "billigfluege-billige-fluege.de", "bingo-net.com", "bio-snoop.com", "birth-control-links.com", "bizhat.com", "bj-cas.cn", "bj-fyhj.com", "bj-hchy.com", "bjerwai.com", "bjgift.com", "bjkhp.com", "bjxhjy.com", "bla5.com", "black-amateur-cock.net", "black-dick-white-slut.com", "black-girls.blowsearch.ws", "black-jack-4u.net", "black-jack-trx.com", "blackbusty.com", "blackjack-123.com", "blackjack-21.ws", "blackjack-4u.net", "blackjack-777.net", "blackjack-8.com", "blackjack-dot.com", "blackjack-homepage.com", "blackjack-p.com", "blackjack-play-blackjack.com", "blackjack-winner.net", "blackjack.fm", "blackjack777.net", "blackjacksite.net", "blahblah.tk", "blk-web.de", "bllogspot.com", "blog-tips.com", "bloglabs.biz", "blogman.biz", "blogmen.net", "blogspam.org", "blonde-pussy.us", "blonde-video.us", "blonde-xxx.us", "blondes2fuck.com", "blumengruss-onlineshop.de", "blumenshop-versand.de", "bnetsol.com", "body-jewelry.reestr.net", "body-piercing.softinterop.com", "bodyjock.com", "bon-referencement.com", "bondage-story.blogspot.com", "boobmorning.com", "boobspost.com", "booktextone.com", "boom.ru", "borindonaragara.com", "boysgonebad.net", "brazilbang.biz", "breast-augmentation.top-big-tits.com", "briana-banks-dot.com", "british-hardcore.net", "bszz.com", "bueroversand-xxl.de", "bugaboo-stroller.com", "build-penis.com", "bulkemailsoft.com", "burningcar.net", "burundonamagara.com", "business-grants.org", "business-web-site.net", "businessgrants.biz", "busty-models.us", "bustyangelique.com", "bustydustystash.com", "bustykerrymarie.com", "butalbital.org", "buy-2005-top.com", "buy-2005.com", "buy-adult-sex-toys.com", "buy-adult-toys.biz", "buy-car-insurance-4-us.com", "buy-ceramics.com", "buy-cheapest-lexapro-side-effects-noprescription.biz", "buy-cialis.ws", "buy-computer-memory.net", "buy-computer.us", "buy-discount-airline-tickets.com", "buy-laptop.biz", "buy-rx-usa.com", "buy-sex-toys.net", "buycheapcialis", "buycheappills.net", "buyhgh", "buylipitor", "buyprilosec", "buystuffpayless.com", "buyzocor", "byronbayinternet.com", "c-start.net", "ca-america.com", "ca-s-ino.com", "calendari-donne.com", "calendari-donne.net", "calendaridonne.com", "calendaridonne.net", "california-real-estate-sale.com", "callingcardchoice.com", "cambridgetherapynotebook.co.uk", "camemberts.org", "canadianlabels.net", "cantwell2000.com", "canzoni-italiane.com", "canzoni-italiane.net", "canzoni-italiane.org", "canzoni-karaoke.com", "canzoni-mp3.com", "canzoni-mp3.us", "canzoni-musica.com", "canzoni.cc", "canzonisanremo.com", "canzonistraniere.com", "capital-credit-cards.com", "capquella.com", "captain-stabbin-4u.com", "captain-stabbin.blogspot.com", "car-financing-low-rates.biz", "car-fuck.net", "car-rental-links.com", "car-rental-search.com", "car-rentals-2go.com", "card-games-tfx.com", "cardsloansmortgages.com", "caribbean-poker-web.com", "carnalhost.com", "carnumbers.ru", "cars-links.com", "cartoni-animati.com", "cartoni-hentai.com", "cartoni-hentai.net", "cartoni-hentai.org", "cartoni-porno.com", "cartonierotici.com", "cartonigiapponesi.com", "cartonihentai.net", "cartopia.com", "cas7.net", "cash-advance-quick.com", "cashadvanceclub.com", "casino-bet-casino.com", "casino-cash.net", "casino-en-ligne.fr.vu", "casino-game-trx.com", "casino-games-4-us.com", "casino-games-i.com", "casino-gaming-trx.com", "casino-in-linea.it.st", "casino-jp.com", "casino-on-net.com", "casino-online-i.com", "casino-online-on-line.com", "casino-onnet-bonus.com", "casino-slot.ws", "casino-wins.net", "casino.150m.com", "casino.menegum.co.uk", "casino747.net", "casinochique.com", "casinoequipmentsalesandrental.com", "casinolasvegas-online.com", "casinoplaces.net", "casinos-8.com", "casinos-jp.com", "casinos-plus.com", "castingagentur2004.de", "catchathief.org", "cbitech.com", "ccie-ccnie.com", "ccie130.com", "ccna-ccna.com", "ccna130.com", "ccnp-ccnp.com", "ccnp130.com", "cds-xxl.de", "cdshop-guenstig.de", "celebrexonline.us", "celebritylust.blog-city.com", "celebritypics.ws", "celebskin.com", "celebtastic.com", "cell-phone-accessories-dot.com", "ceramics-store.com", "certificationking.net", "certified-new-autos.com", "certified-new-cars.com", "certified-new-suvs.com", "certified-used-cars.com", "certified-used-suvs.com", "cesew.org", "charisma.dyndns.dk", "chat-l.de", "chatten.bilder-j.de", "chauffeurtours.co.uk", "cheap-adult-sex-toys.com", "cheap-airfare-airline-ticket.com", "cheap-celebrex-prescriptions.com", "cheap-christmas-gifts.co.uk", "cheap-cigarettes.com", "cheap-laptop-notebook.netdims.com", "cheap-online-pharmacy.org", "cheap-pills-online.com", "cheap-web-hosting-companies.com", "cheapacyclovir.com", "cheapcodeine.biz", "cheapdrugpharmacy.com", "cheaper-digital-cameras.uk.com", "cheaper-loans.eu.com", "cheapest-pills-online.com", "cheapgenericsoma.info", "cheapsomaonline.biz", "cheaptabs.envy.nu", "checkmeds.com", "cherrybrady.com", "chickz.com", "chillout.bpa.nu", "chinaaircatering.com", "chinagoldcoininc.com", "chineseapesattack", "chloesworld.com", "choose-online-university.com", "chrislaker.co.uk", "christmas-casino.spb.ru", "cialis-buy.com", "cialis-dot.com", "cialis-express.com", "cialis-weekend-pills.com", "cialis.homeip.net", "cialisapcalis.com", "cialisnetwork.com", "cialisusa.bravehost.com", "ciscochina.com", "clamber.de", "clanbov.com", "classifiche-italiane.org", "classifiche-musicali.com", "classifiche-musicali.net", "classifiche-musicali.org", "classifichemusicali.com", "claudiachristian.co.uk", "claypokerchips-claypokerchips.com", "cleanadulthost.com", "cleannbright.co.uk", "click-or-not.de", "click-poker.com", "clophillac.org.uk", "closed-network.com", "club-online-poker", "club69.net", "clubatlantiscasino.com", "cmeontv.de", "cnbjflower.com", "cngangqiu.com", "cntoplead.com", "coed-girls.com", "coffee-delivered.com", "college-girl-pic.com", "college-links.net", "college-scholarships-grants.biz", "combaltec.com", "comeback.com", "cometojapan.com", "cometomalaysia.com", "cometosingapore.com", "cometothailand.com", "completelycars.com", "completelyherbal.com", "comptershops-online.de", "computer-onlinebestellung.de", "computer-und-erotische-spiele-download.com", "computerversand-xxl.de", "condodream.com", "condosee.com", "conjuratia.com", "consolidate-debt-usa.net", "consolidation-loans.com", "container-partner.de", "cool-extreme.com", "cool-mix.com", "cool-poker.com", "coolp.biz", "coolp.net", "coolp.org", "coresleep.com", "cosmeticsurgery.us", "cosmeticsurgery.us.com", "couponmountain.com", "cover-your-feet.com", "crazyfrog.wtf.la", "creamfilledholes.biz", "credit-cards-credit-cards-credit-cards.net", "credit-factor.com", "credit-links.net", "credit-loans-2005.com", "credit-report-links.net", "creditcardpost.com", "creditrepairsoft.com", "creditsharpie.com", "crepesuzette.com", "crescentarian.net", "crpublish.com", "cum-facials.us", "cumfiesta-4u.com", "cumfietavideos.com", "cumlogin.com", "customer-reviews.org", "cutpricepills.com", "cyberfreehost.com", "cycatki.com", "cyclo-cross.co.uk", "cykanax.com", "dad-daughter-incest.com", "daiiuvwx.com", "dailyliving.info", "dallmayr.de", "damianer.top-100.pl", "danni.com", "darest.de", "darkangelclan.com", "darzgx.com", "datestop.net", "dating-choice.com", "dating-harmony.com", "dating-online-dating.org", "dating-service-dating.com", "dating-services-dating-service.com", "dating999", "dating999.com", "davidtaylor.topcities.com", "day4sex.com", "debt-consolidation-i", "debt-consolidation-i.biz", "debt-consolidation-kick-a.com", "debt-consolidation-low-rates.biz", "debt-consolidation-now-online.com", "debt-disappear.com", "debt-help-bill-consolidation-elimination.com", "debt-solution-tips.com", "debtconsolidationfirm.net", "debtconsolidationloans", "debtconsolidationusa.org", "debtmanagementcompanyonline.com", "dedichepersonali.com", "deep-ice.com", "deikmann.de", "dental-insurance-plan.freeservers.com", "dental-plan-source", "dentalinsurancehealth.com", "department-storez.com", "design4u.ws", "desiraesworld.com", "deutschlandweite-immobilienangebote.de", "devilofnights.net", "devilofnights.org", "devon-daniels.com", "devonanal.com", "dia-host.com", "dianepoppos.com", "diarypeople.com", "dick-deputy.com", "diecastdot.com", "diet-doctor.net", "diet-pills-now", "dieta-dimagrante.net", "dieta-mediterranea.net", "dieta-zona.com", "dieta.cc", "diete-dimagranti.com", "diete.bz", "diethost.net", "dieting-review.com", "dietpage.net", "dietpatchformula.com", "dietrest.com", "diets-health.com", "diets-plan.net", "dietway.net", "digital-projector.net", "digitale-teile.de", "digitaltwist.co.uk", "direct-contact.com", "direct-deals-for-you.info", "direct-tv-for-free.com", "direct-tv-online.com", "directcarrental.com", "directcti.com", "directrape.com", "directringtones.com", "dirty-story.blogspot.com", "discount-airfares-guide.com", "discount-cheap-dental-insurance.com", "discount-life-insurance.us", "discountprinterrefill.com", "discoveryofusa.com", "dish-network-w.com", "dish-network.org", "disigncn.com", "disney-hentai.org", "divorce-links.com", "dlctc.com", "dnpose.com", "dns110.com", "dns2008.cn", "dogfartmovieclips.com", "dogfartmovieclips.com", "dogolz.de", "domkino.com.ua", "donne-belle.net", "donne-famose.biz", "donne-muscolose.net", "donne-muscolose.org", "donne-nere.net", "donne-nere.org", "donne-nude.biz", "donne-porche.com", "donne-vogliose.com", "donne.bz", "donnebelle.net", "donnefamose.biz", "donnegrasse.org", "donnemature.biz", "donnemuscolose.com", "donnenere.com", "donnenere.net", "donnenude.biz", "donneporche.org", "donnesexy.org", "donnevogliose.net", "donnevogliose.org", "doo.pl", "doobu.com", "doorway-page-software", "dostweb.com", "dotcomup.com", "downloadzipcode.com", "dr.ag", "dragonball-porno.com", "dragonball-x.biz", "dragonball-xxx.biz", "dragonballporno.net", "dragonballx.cc", "dragonballxxx.biz", "dressagehorseinternational.co.uk", "drive-backup.com", "drochka.com", "drugsexperts.com", "drugstore-online.us", "drugstore.st", "drunk-girls-flashing.com", "drunk-girls-party.us", "dunecliffesaunton.co.uk", "dvd-copier.info", "dvd-home-theatre.com", "dvd-top-shop.info", "dvd2.us", "dwoq.com", "dzwonki-polifoniczne-motorola.webpark.pl", "e--pics.com", "e-best-poker.com", "e-bookszone.com", "e-casino-bonus.com", "e-cialis.net", "e-credit-card-debt.com", "e-debt-consolidation-loans.com", "e-dental-insurance-plans", "e-dental-plans.com", "e-discus.com", "e-fioricet.com", "e-free-credit-reports.com", "e-hoodia-gordonii.com", "e-lemonlaw.com", "e-news.host.sk", "e-online-bingo.com", "e-order-propecia.com", "e-personalinjurylawyers", "e-personalinjurylawyers.com", "e-pills-buy.com", "e-play-bingo.com", "e-poker-games.info", "e-southbeachdiet.com", "e-top-pharmacy.com", "e-tutor.com", "e-virtual-casino.com", "e40.nl", "easy-application-credit-cards.com", "easygo.hn.org", "easyrecorder.com", "easyseek.us", "ebanking.info", "ebaybusiness.net", "ebloggy.com", "ebony-girls.angelcities.com", "ebony-xxx.us", "ebookers.co.uk", "ecblast.com", "eccentrix.com/members/casinotips", "echofourdesign.com", "eclexion.net", "ecologix.co.uk", "eddiereva.com", "edietplans.net", "edmontgomeryministries.org", "edpowerspasswords.com", "edrugstore.md", "education-line.com", "edwardbaskett.com", "effexor-web.com", "effexor.cc", "eggesfordhotel.co.uk", "egygift.com", "einfach-wunschgewicht.com", "elcenter-s.ru", "eldorado.com.ua", "electricscooterland.com", "electromark-uk.co.uk", "electronics-info.com", "elegant-candles.com", "elektronikshop-xxl.de", "elite-change.com", "elitecities.com", "emmasarah.com", "emmss.com", "enacre.net", "enjoy-blackjack.com", "enlargement-for-penis.com", "envoyer-des-fleurs.com", "eonsystems.com", "epaycash.com", "erbium12.com", "erosway.com", "erotic-free.com", "erotic-lesbian-story.blogspot.com", "erotic-video.us", "erotic4free.net", "erotische-geschichten-portal.com", "escort-links.net", "escorts-links.com", "esesso-gratis.com", "esmartdesign.com", "ethixsouthwest.com", "evananderson.topcities.com", "evanstonpl.org", "event-kalendarium.de", "everyvoice.net", "evromaster.ru", "exclaim4creditcardprocessingmerchantaccount.com", "exdrawings.com", "exoticdvds.co.uk", "exoticmoms.com", "expoze.com", "extrasms.de", "extreme-rape.org", "extreme-sex.org", "f-z-a.com", "f2g.net", "f2s.be", "fabida.net", "fabulos.de", "fabuloussextoys.com", "facial-skin-care-center.com", "family-incest-stories.com", "family-incest.us", "familydiet.org", "famousppl.me.uk", "fantasyfootballsportsbook.com", "farm-beastiality.com", "farmsx.com", "fast-cash-quick-money-easy-loan.com", "fast-fioricet.com", "fast-mortgage-4-u.com", "fasthost.tv", "fat-cash.com", "fat-lesbians.net", "fat-pussy-sex.net", "fateback.com", "fatty-liver.cn", "fatwarfare.com", "favilon.net", "fda.com.cn", "fearcrow.com", "federalgovernmentgrants.net", "feidenfurniture.com", "female-orgasms.org", "fidelityfunding.net", "fielit.de", "figa.nu", "film-porno.us", "film456.com", "filthserver.com", "final-fantasy-hentai.org", "finance-world.net", "finanzen-marktplatz.de", "find-cheap-dental-plans.com", "find-lesbian-porn.com", "find-u-that-mortgage.com", "findbestpills", "findbestpills.com", "findbookmakers.com", "finddatingsites.com", "findsexxx.us", "findyouruni.com", "finger-bobs.com", "fioricet-dot.com", "fioricet-online-here.com", "fioricet-web.com", "fioricet.batcave.net", "fioricet.bravehost.com", "fioricet.st", "fioricet4u", "first-poker.com", "first-time-story.blogspot.com", "firstchoicebanksandpremiercredit.com", "firsttimeaddition.com", "fishoilmiracle.com", "fitness-links.net", "fitnessx.net", "flafeber.com", "flatbedshipping.com", "fleshlight.org", "fleshlight.ro", "flexeril-web.com", "flirt08.de", "flowertobj.com", "fly-sky.com", "football--betting.net", "football-betting-nfl.com", "forceful.de", "foreskin-restoration.net", "forex-online-now.com", "forex.inc.ru", "forexintroducer.com", "forlovedones.com", "fortisenterprises.co.uk", "foto-gay.us", "foto-porno.us", "foto-porno.ws", "frangelicasplace.org", "frankpictures.com", "freak-view.com", "freakycheats.com", "free--online--poker", "free--online-poker.com", "free--online-poker.us", "free-adult-chat-room.com", "free-adult-check.com", "free-blackjack-game.us", "free-britney-spears-nude.biz", "free-casino-games", "free-casino-games-000", "free-debt-consolidation-online.us", "free-fast.net", "free-games-links.com", "free-gay-video-clip.com", "free-hilton-paris-sex-video.com", "free-horoscopes.biz", "free-incest-stories-site.com", "free-net-sex.com", "free-online-poker", "free-paris-nikki-hilton.blogspot.com", "free-poker-download-i.com", "free-poker-great-value.com", "free-poker-rooms.us", "free-satellite-tv-directv-nocable.com", "free-satellite-tv-now.com", "free-teens-galleries.com", "free-texashold-em.us", "free-texasholdem.us", "free-traffic-generation.com", "freeadult.de", "freedvdplayer.cjb.net", "freeeads.co.uk", "freegovmoney.net", "freegovmoney.us", "freehostingpeople.com", "freehustlersex.com", "freeminimacs.com", "freenetshopper.com", "freenudegallery.org", "freepicsdaily.com", "freepornday.com", "freeteenpicsandmovies.com", "freeweb-hosting.com", "freewebpage.org", "freewebs.com", "freewhileshopping.com", "freshsexhosting.com", "friko.pl", "fsearch.dtdns.net", "fuck-animals.com", "full-access.net", "fumetti-porno.org", "fumettiporno.org", "furrios.de", "furry-kinks-looking.com", "furry-kinks-looking.net", "future-2000.net", "g4h5.com", "gaggingwhores.net", "gaggingwhores.org", "gagnerargent.com", "gainmoresize.com", "gals4all.com", "galsonbed.com", "gamble-on-football-online.com", "gambleguru.net", "gambling-a.us", "gambling-card.ws", "gambling-casinos-trx.com", "gambling-homepage.com", "games.cc", "gamblingguidance.co.uk", "gamefinder.de", "games-advanced.de", "gang-rape.org", "gangbangbusgallery.com", "gargzdai.net", "garment-china.com", "gartenshopper.de", "garthfans.co.uk", "gay-asian-porn.com", "gay-b.com", "gay-boy.us", "gay-male-story.blogspot.com", "gay-nude.us", "gay-sex-videos.com", "gay-twinks-sex.com", "gay1ncest.com", "gayfamilyincest.net", "gayfunplaces.com", "gays-porno-men-twinks-boys-sex.biz", "gays-sex-gay-sex-gays.us", "gayx.us", "gb.com", "gdgc.org", "gelago.de", "gem2.de", "gemtienda.co.uk", "generic-propecia.net", "genimat.220v.org", "genimat.cjb.net", "geocities.com/alexgolddphumanrbriar", "geocities.com/avbmaxtirodpaulmatt", "geocities.com/brandtdleffmatthias7", "geocities.com/cclibrannar_rover", "geocities.com/constpolonskaalniko7", "geocities.com/forestavmiagdust", "geocities.com/free_satellite_tv_dish_system", "geocities.com/gehentaiqrst", "geocities.com/gematureqrst", "geocities.com/gerapeqrst", "geocities.com/ofconvbdemikqfolium", "geocities.com/pashkabandtvcom", "geocities.com/pautovalexasha_kagal", "geocities.com/reutovoalexeypetrovseverin5", "geocities.com/timryancompassmedius", "gesundheit-total.com", "gesundheitsshop-kosmetik.de", "get-cell-phone-accessories.com", "get-free-catalogs.com", "get-freetrial.us", "get-hardcore-sex.com", "get-insurance-quotes.com", "get-satellite-tv-dish.com", "get-your-dish-tv.info", "get-zoo.com", "getaprescription.net", "getdomainsandhosting.com", "gethelp24x7.net", "getmoregiveless.com", "getrxscripts.biz", "getstarted24x7.net", "getyourlyrics.com", "gfind.de", "ghettoinc.com", "giantipps.de", "gifs-clipart-smiley.de", "giochi-hentai.com", "giochi-online.us", "giochix.com", "girls-get-crazy.org", "girlshost.net", "give-u-the-perfect-mortgage.com", "giveramp.com", "glendajackson.co.uk", "global-verreisen.de", "globalwebbrain.com", "glory-vision.com", "gloryhole-girls.angelcities.com", "glucophagepharmacy.com", "goapplyonline.com", "godere.org", "godwebdesign.com", "gogito.com", "gogof-ck.com", "gojerk.com", "goldpills.net", "gomvents.com", "gongi.pl", "goodlife2000-geheimtipp.com", "goodsexy.com", "goodtv.cn", "google163.net", "google8.net", "gorilka.atspace.com", "gotooa.com", "gotsw.net", "gourmondo.de", "govermentgrants.net", "government--grant.com", "government-federal-grants.com", "government-grants.org", "government-grants.ws", "governmentalgrants.com", "governmentfederalgrants.com", "governmentgrants.tv", "governmentgrants.ws", "governmentgrantsresources.com", "grannypictgp.com", "grannysexthumbs.com", "grants.biz", "grantseekerpro", "great-cialis.com", "great-dish-tv-deals.info", "greatnow.com", "greecehotels-discount.com", "green-tx.com", "greenwood.ddns.ms", "group-eurosex.com", "growtech.cn", "guardami.org", "guenstige-krankenversicherung.com", "guenstige-onlineshops.de", "guenstige-sportartikel.de", "guenstige-versicherungstarife.de", "gunit.gotdns.com", "guttermag.com", "hair-loss-cure-x.com", "hair-loss-cure.net", "hairy-pussy-sex.net", "hallo-tierfreund.de", "hand-job.us", "handjoblessons.org", "handmade2000.co.uk", "handsm.servehttp.com", "handwerksartikel-xxl.de", "handy-klingeltoene.eu.tp", "handysprueche.de", "handytone.us", "hangchen.cn", "hangchen.com", "happy-shopping-online.com", "happyagency.com", "hard-sex-teen.com", "hardcore-jpg.com", "hardcore-junky.us", "hardcore-pictures.us", "hardcore-porn-links.com", "hardcore-pussy.us", "hardcore-sex.bz", "hardcore-video.us", "hardcorecash.net", "hasslerenterprises.net", "hasslerenterprises.org", "hautesavoieimmobilier.com", "hchcinc.com", "hdic.net", "hdic.org", "headachetreatment.net", "health-pills-online.com", "health-pills.net", "healthmore.net", "healthrules.org", "heartbeatofhealing.org", "helpful-forum.com", "helpful-pills-blog.com", "hentai-anime.us", "hentai-gratis.us", "hentai-hard.com", "hentai-porno.us", "hentai-xxx.us", "hentaigratis.net", "hentaimanga.us", "hentaiplayground.com", "hentaix.net", "hentaixxx.us", "hentay.us", "herbal-source.net", "hermosa.us", "herpies.net", "heydo.com", "hghadvisor.com", "hghplanet.com", "hgxweb.de", "hi-finder.com", "high-risk-merchant-account.org", "highprofitclub.com", "hilton-nicky-paris.blogspot.com", "hion.cn", "hit-logo-klingelton.com", "hit-logo-ringetone.com", "hit-logo-ringtone.com", "hit-logo-suoneria.com", "hit-melodias.com", "hit-sonnerie.net", "hit-sonneries.com", "hits-logos-games.com", "hits-logos-klingeltone.com", "hitslogosgames.com", "hlopci.w5.pl", "hobbs-farm.com", "hold-em-big.com", "hold-pok.com", "holdem-texaspoker.com", "holding.errorworld.org", "home-design.ws", "home-equity-loans-mortgage-refinancing.com", "home-loans-inc.com", "home-style.ws", "home-videos.net", "home.pages.at", "home.ro", "homelivecams.com", "homenetworkingsolutions.co.uk", "hometeaminspection.net", "hometeaminspection.org", "hoodia--gardonii.com", "hoodia.belleity.com", "horny-honey.com", "horny-world.com", "hornymoms.net", "hornypages.com", "horoskop-auswertung.de", "horse-racebetting.com", "horse-racing--betting.net", "horse-sex.ws", "hostingplus.com", "hostultra.com", "hot-cialis.com", "hot-escort-services.com", "hot-mates.info", "hot-naked-guys.net", "hotel-bordeaux.cjb.net", "hotelbookingserver.com", "hotelsaficionado.com", "hotelsplustours.com", "hotfunsingles.com", "hotsexys.com", "hotusa.org", "houseofsevengables.com", "how-quit-smoking.com", "how-to-play-poker-quick.com", "hq-pictures.org", "hs168.com", "hswin.com", "htmldiff.com", "huazhangmba.com", "humangrowthhormone.org", "hunksandbabes.com", "hustler.bz", "hustlerbarelylegalteen.com", "hustlerw.com", "hxlll.net", "hyper-sex.com", "hypnobabies.co.uk", "i--cialis.net", "i-black-jack.com", "i-butalbital-fioricet.com", "i-buy-mortgage.com", "i-directv.net", "i-dish-network.org", "i-flexeril.com", "i-free-poker.com", "i-horny.com", "i-ink-cartridges.com", "i-mortgage-online.com", "i-online-bingo.com", "i-online-poker.com", "i-play-bingo.com", "i-play-blackjack.com", "i-play-casino.com", "i-play-poker-online.biz", "i-play-poker-online.com", "i-play-poker-online.us", "i-play-poker.com", "i-skelaxin.com", "i-soma.net", "i-university-guide.com", "i-wellbutrin.com", "i-will-find-the-best-mortgage-lead.com", "i-win-bingo.com", "idebtconsolidation.org", "idp4u.com", "ifreepages.com", "iipgoulkdfghj.com", "illegalhome.com", "illegalspace.com", "im-naked.com", "imagenes-tops.com.mx", "imess.net", "imitrex-web.com", "immagini-hentai.org", "immobilien-auswaehlen.de", "immobilienangebote-auswahl.de", "immobilienmakler-angebote.de", "immobilienmakler-l.de", "immobilienmarkt-grundstuecke.de", "immobilierdessavoie.com", "imobissimo.com", "impotence-rx.biz", "in-the-vip.org", "inc-magazine.com", "incest-movies-download.com", "incest-photo.com", "incest-photos-archive.com", "incest-pics--incest.com", "incest-pics-gallery.com", "incest-reality.com", "incest-relations.com", "incest-stories-library.com", "incest-stories.biz", "incest-taboo.net", "incest-videos-collection.com", "inceststories.ws", "incredishop.com", "incsx.com", "indian-sex-porno-movies-stories.com", "indiasilk.biz", "indiasilktradition.com", "industrial-testing-equipment.com", "industrialresource.biz", "inescudna.com", "inexpensiverx.net", "infocenter-crm.com", "inforceable.com", "inforceables.com", "ingyensms.net", "ingyensms.org", "innfg.de", "insatiablepussy.com", "inside.afraid.org", "instant-quick-money-cash-advance-personal-loans-until-pay-day.com", "instantsatellite.com", "insurance-quotes-fast.com", "insurancecompanies4you.com", "insurancehere.net", "int-fed-aromatherapy.co.uk", "inter-ross.ru", "international-candle-shop.com", "international-cheese-shop.com", "internet-meds.biz", "internet-merchant-account-pro.com", "internet-poker-online-4-u.com", "internette-anbieter.de", "interracial-sex.ws", "inthevip-4u.com", "inthevip-sex.com", "intimplace.com", "intymnie.com", "inviare-mms.net", "invio-mms.us", "ipaddressworld.com", "ipharmacy.com", "ipmotor.com", "ipsnihongo.org", "ipupdater.com", "irianjaya.co.uk", "irs-us.net", "isacommie.com", "iservice.eu.com", "isparkl.com", "itgo.com", "iul-online.de", "iwebbroker.com", "jack-x.com", "jade.bilder-i.de", "japan-partner.com", "jenniferconnor.com", "jewelry4navel.com", "jfcadvocacy.net", "jinlong.co.uk", "jmsimonr.com", "job-interview-questions-tips.com", "jobsearchlegal.com", "johnhowesatty.com", "johnhuron.com", "jokeria.de", "jordanand.topcities.com", "josephlied.com", "judahskateboards.com", "juega-al-casino.com", "juliamiles.co.uk", "jungfrauen-sex.com", "junyuan.com.cn", "justasex.com", "jytouch.com", "kantorg.h10.ru", "kapsociety.org", "kardtoons.co.uk", "karibubaskets.com", "karmicdebtconsolidation.com", "kcufrecnac.com", "keikoasura.com", "keithandrew.co.uk", "kewl-links.com", "kewler.net", "kinggimp.org", "kinky-teen-videos.com", "kinkyhosting.com", "kiranthakrar.co.uk", "kleinkinder-shop.de", "klik-search.com", "klingeltoene-handylogos.de.be", "klingeltone-logo.com", "klitoris.ca", "kmsenergy.com", "kohost.us", "koihoo.com", "kontaktanzeigen-bild.de.ms", "kontaktlinsen-partner.de", "kostenlose-sexkontakte.org", "krantas.org", "kraskidliavas.ru", "kredit-ratenkredit-sofortkredit.de", "kredite-online.de.ms", "kredite-portal.de", "kredite-sofortzusage.de", "kreditkarten-sofort.de.ms", "kupibuket.ru", "kyed.com", "kyfarmhouse.org", "lablog.biz", "lacetongue.com", "lach-ab.de", "lakesideartonline.com", "lambethcouncil.com", "landscape-painting.as.ro", "langsrestaurant.com", "lanreport.com", "laptopy.biz.pl", "las-vegas-real-estate-1.com", "lastminute-blitz.de", "lasvegas-real-estate.net", "lasvegasrealtor.com", "lasvegastourfinder.com", "latina-hot-girls.com", "latina-sex.ws", "lavalifedating.com", "leadbanx.com", "learnhowtoplay.com", "lebonpost.com", "lechery-family.com", "legalblonde.com", "lesbian-girl.us", "lesbian-sex-porn-pics-stories.com", "lesbichex.com", "lesbo-rama.com", "leseratten-wunderland.de", "letemgo.de", "leveltendesign.com", "lexapro-web.com", "lexfinance.com", "lgt-clan.ru", "life-insurance-advisor.com", "lifeinsurancefinders.com", "likesmature.com", "lingerie-land.com", "link-dir.com", "linkliste-geschenke.de", "linseysworld.com", "linuxwaves.net", "lipitordiscount.biz", "lipitordiscount.com", "lir.dk", "lisaber.com", "list1st.com", "listbanx.com", "live-casino.com", "livetexasholdem.com", "livetexasholdem.com", "livetexasholdem.com", "livetexasholdem.com", "livetreff.tv", "livevents.de", "lizardofoz.com", "lizzie.dyndsl.com", "lizziemills.com", "loan-king.com", "loan-superstore.com", "loaninfotoday.com", "loans-4all.com", "loans-no-fax.com", "loans.de.vu", "locationcorse.free.fr", "logo-beltonen.com", "logo-free.com", "logo-klingeltone.com", "logo-max.com", "logo-melodias.com", "logo-mobiel.com", "logo-mobile-repondeur.com", "logo-moviles.com", "logo-phones.com", "logo-repondeur-mobile.com", "logo-sonneries-sonnerie.com", "logo-spiele.com", "logo-tones.com", "logod-helinad-mangud.com", "logoer-mobil.com", "logos-downloads.com", "logos-free.com", "logos-logos.be", "logos-melodijas-speles.com", "logos-mobile-repondeurs.com", "logos-phones.com", "logos-repondeurs-mobile.com", "logos-sonneries-jeux.com", "logos-sonneries-jeuxmobiles.com", "logos-sonneries-sonnerie.com", "logos-tone.com", "logosik.pl", "logotyper-mobil.com", "lolika.net", "longslabofjoy.com", "lookforukhotels.com", "loraxe.com", "low-low-rates.com", "lowclass.de", "lowcost.us.com", "lowest-rates-mortgages.com", "lowinterestratecreditcards.net", "luffassociates.co.uk", "luxus-gourmetartikel.de", "lvcpa.net", "lvcpa.org", "lvrealty.net", "lynskey-admiration.org.uk", "lyriclovers.com", "macinstruct.net", "mail333.com", "mainentrypoint.com", "mainjob.ru", "majorapplewhite.info", "male-enlargement.com", "mallorycoatings.co.uk", "maloylawn.com", "mandysdiary.biz", "mandysdiary.ws", "manga-free.net", "manga-free.org", "manga-porn.us", "manga-x.biz", "manga-xxx.org", "manufacturers-blog.com", "march--madness.biz", "march--madness.info", "march--madness.org", "marcomdeal.com", "marshallsupersoft.com", "marshallyachts.org", "marteq-on.com", "match-me-up.com", "mature-big-tits.net", "mature-old-mature.com", "mature-sex-moms-porn.com", "matureacts.com", "maturefolk.com", "maturetours.com", "maxigenweb.com", "mbgeezers.com", "mcdortaklar.com", "mcfimortgage.com", "medcenterstore.com", "mediaaustralia.com.au", "mediavisor.com", "medical4order.com", "medications-4all.com", "medicine-supply.com", "medicinecheaper.com", "medicinetrail.org", "meds-pill.com", "medweightloss", "medyep.com", "mega-spass.com", "megapornstation.com", "melincs.org", "melodias-logos-juegos.com", "members.fortunecity.com/kennetharmstrong", "men-porn.us", "men-sex.us", "menexis.com", "mengfuxiang.com", "menguma.co.uk", "menguma.com", "mens-health-pills.com", "menservers.com", "menzyme.com", "merditer.com", "merseine.nu", "mesothelioma-asbestos-help.com", "mesothelioma-health.com", "mesothelioma.net", "metroshopperguide.com", "mettle.com.cn", "michigan-attorney.lbgo.com", "micrasci.com", "microsoft-com.us", "middlecay.net", "middlecay.org", "midget-porn-sex.com", "mietangebote-domain.de", "migraine-relief.com", "mikebunton.com", "milesscaffolding.co.uk", "milf-hardcore.net", "milf-rider.us", "milfporn.org", "mingholee.com", "misterwolf.net", "mmorpg-headlines.com", "mmsanimati.com", "mneuron.com", "mobile-repondeur-logo.com", "mobile-repondeurs-logos.com", "mobilefamilydental.com", "mobilequicksale.com", "mobilesandringtones.com", "mode-domain.de", "mode-einkaufsbummel.de", "moltobene.ru", "monavaletoys.com", "money-cash-loans.com", "money-room.com", "moneybg.com", "montaguefineart.com", "mookyong.com", "mor-lite.net", "mor-lite.org", "moris-dada.com", "mortage-4all.com", "mortgage-info-center.com", "mortgage-rates-guide.net", "mortgagemarketinginc.com", "mortgagequestaz.com", "mortgagerates4all.com", "mortgages-links.net", "mortloan.com", "mostika.us", "mother-son-incest-sex.net", "motonet.pl", "movies6.com", "mp-forum.com", "mp3download.bz", "mp3x.biz", "mpeg2pci.com", "mrgoicoechea.com", "mrn.vip.sina.com", "mrpiercing.com", "multipurpose-plants.net", "multiservers.com", "music-downloads-links.com", "musica-da-scaricare.net", "musica-gratis.biz", "musica-gratis.org", "musica-karaoke.net", "musica-mp3.biz", "musicamp3.us", "musicbox1.com", "musiccheap.us", "musicenergy.com", "muxa.ru", "mxbearings.com", "my-age.net", "my-dating-agency.com", "my-discount-cigarettes.com", "my-sex-toys-store.com", "myasiahotels.com", "mybestcasinos.net", "mybestclick.com", "mycasinohome.com", "mycheapcigstore.com", "mycialispharmacy.com", "mydatingagency.com", "mydietdoctor.com", "myeuropehotels.com", "myfavlinks.de", "mygenericrx.com", "myrice.com", "myrtlejones.com", "myslimpatch.com", "mystify2001.com", "naar.be", "nabmilor.com", "nabmlior.com", "nabpak.org", "naked-gay.us", "naked-pussy.us", "naked-womens-wrestling-league-dvds.com", "naked-womens-wrestling-league-videos.com", "nakedboysfirsttime.com", "nancyflowerswilson.com", "narod.ru", "nasty-pages.com", "natel-mobiles.com", "natural-barleygreen.com", "natural-breasts-enhancement.net", "naturalknockers.net", "nehrucollege.org", "neiladams.org.uk", "net-mature.com", "net-von-dir.de", "netdims.com", "netizen.org", "netleih.de", "netlogo.us", "netsx.org", "neurogenics.co.uk", "new-cialis.com", "neweighweb.net", "neweighweb.org", "newfurnishing.com", "newgallery.co.uk", "newmail.ru", "newsnewsmedia.com", "newtruths.com", "newxwave.com", "nfl-football-tickets.biz", "nice-pussy.us", "nicepages.biz", "nicepages.net", "nicepages.org", "niceshemales.net", "nichehit.com", "nicolepeters.com", "nieruchomosci.biz.pl", "nifty-erotic-story-archive.blogspot.com", "niibacca.afraid.org", "nikkiwilliams.info", "njhma.com", "njunite.net", "no-cavities.com", "no-title.de", "no1pics.com", "nohassle-loans.com", "noni-jungbrunnen.com", "noni-top-chance.com", "noni-vitalgetraenk.com", "noniexpert.com", "nonstop-casino.com", "nonstopsex.org", "noslip-picks.com", "notsure.de", "novacspacetravel.com", "now-hiringsluts.com", "nr-challenges.org", "nude-black.us", "nude-celebrity-dvd.com", "nude-movies.us", "nude-teens.name", "nude-video.us", "nudevol.us", "nutritional-supplements.ws", "nutritionalsupplementstoday.com", "nutzu.com", "nwwl-dvds.com", "nwwl-videos.com", "nylonex.com", "nz.com.ua", "odrducmibedfghj.com", "officexl.de", "officezl.com", "officialdarajoy.com/wwwboard", "officialdentalplan.com", "officialsatellitetv.com", "offseasonelves.com", "ohamerica.org", "okuk.org", "old-sexy-sluts.com", "olderr.4t.com", "oldgrannyfucking.com", "oliviagadamer.com", "omega-fatty-acid.com", "on-line-casino-deutsch.com", "on-line-casinos-online.com", "on-line-casinos-online.net", "on-line-degree.org", "on-line-kasino-de.com", "on-pok.com", "one-blackjack.com", "one-cialis.com", "one-debt-consolidation.com", "one-poker-online.com", "one-propecia.com", "one-soma.com", "onepiecex.net", "oneseo.com", "onexone.org", "online-----poker", "online--blackjack.info", "online--pharmacy.us", "online--sports-betting.com", "online-auction-tricks.com", "online-background-check.biz", "online-black-jack-download.com", "online-blackjack-online.com", "online-buy-plavix.com", "online-credit-report-online.com", "online-dating-com.com", "online-dating-singles-service.com", "online-deals99.com", "online-dot.com", "online-escort-service.com", "online-flexeril.com", "online-gambling-123.biz", "online-gambling-123.us", "online-gambling-online.org", "online-games-links.net", "online-games24x7.com", "online-games24x7.net", "online-generics-store", "online-job-source.com", "online-medications24x7.com", "online-pharmacy-24x7.net", "online-pharmacy-online-pharmacies.com", "online-pharmacy-order.com", "online-photo-print.com", "online-poker--tips.com", "online-poker-200", "online-poker-333.com", "online-poker-555.com", "online-poker-888", "online-poker-a.com", "online-poker-big.com", "online-poker-bonus.us", "online-poker-free.com", "online-poker-guide.info", "online-poker-kick-butt.com", "online-poker-net.com", "online-poker-online-poker", "online-poker-special.com", "online-poker-top-rated.com", "online-prescription-pharmacy.com", "online-prescription.st", "online-prescriptions-internet-pharmacy.com", "online-propecia-buyer.com", "online-sports--betting", "online-sports-betting-source", "onlinedegreehq.com", "onlinegamingassociation.com", "onlinegamingassociation.com", "onlinehgh.com", "onlinepharmacy2004.net", "onlinepoker-dot.com", "onlinepoker-i.com", "onlineshop.us.com", "onlineslotsarcade.com", "onlinesmoker.com", "opensorcerer.org", "operazione-trionfo.net", "optimumpenis.com", "oral-sex-cum.com", "order-claritin.net", "order-effexor.net", "ordernaturals.com", "orlandodominguez.com", "orospu.us", "otito.com", "ottawavalleyag.org", "our-planet.org", "ourhealthylife.net", "ourtownhelps.org", "outoff.de", "overseaspharmacy.com", "ovulation-kit.com", "owns1.com", "ownsthis.com", "p-reise.de", "p5.org.uk", "p6.org.uk", "p7.org.uk", "p8.org.uk", "p9.org.uk", "pacific-poker-top-place.com", "pages4people.com", "pagetwo.org", "pai-gow-keno.com", "painkillersonline.biz", "paisleydevelopmentassociation.org", "pamperedchef-online.com", "paololinks.porkyhost.com", "paperscn.com", "paramountseedfarms.net", "paramountseedfarms.org", "paris-and-nicky-hilton-pictures.blogspot.com", "paris-hilton-video-blog.com", "paris-hilton-videos.biz", "paris-movie-hilton.blogspot.com", "paris-naked-hilton.blogspot.com", "paris-nicky-hilton.blogspot.com", "paris-nikki-hilton.blogspot.com", "parkviewsoccer.net", "parkviewsoccer.org", "partnersmanager.com", "partnersuche-partnervermittlung.com", "party-poker-e.com", "party-poker-leading-site.com", "party-poker-ltd.com", "party-poker-player.com", "party-poker-x", "partybingo.com", "partypoker-i", "partypoker-i.us", "partypoker.com", "partypokeronline.org", "passende-klamotten.de", "passwordspussynudity.com", "pastramisandwich.us", "pasuquinio.com", "payday-cash-loans", "payday-loan", "payday-loan-payday.com", "paydayl0an.com", "paylesspaydayloans.com", "payment-processing.com", "paysites.info", "pc-choices.com", "pcdweb.com", "pedronetwork.com", "pedronetwork.com", "peepissing.com", "penelopeschenk.com", "penilestretch.com", "penis-enlargment.net", "penisimprovement.com", "penisresearch.com", "perfect-dedicated-server.com", "perfect-mortgage-lead-4-u.com", "perkyoneplace.com", "personal-finance-tips.com", "personal-injuries-law.com", "personal-injury-lawyer.us.com", "personalads.us.com", "personales.com", "personals-online-personals.com", "personalserotic.com", "petlesbians.com", "petroglyphx.com", "phantadu.de", "pharmaceicall.com", "pharmacy-links.net", "pharmacy2003.com", "pharmacyprices.net", "philippestarckwatches.co.uk", "phone-cards-globe.pushline.com", "phono.co.il", "photobloggy.buzznet.com", "php5.sk", "phrensy.org", "picnic-basket.more.at", "pics--movies.com", "pics-db.com", "pics-porn.org", "pics-stories.com", "pics-videos.net", "picsfreesex.com", "picsteens.com", "pictures-and-videos.com", "pictures-archive.com", "pictures-movies.net", "pictures-movies.org", "pictures6.com", "piercing-auswaehlen.de", "piercing-magic.com", "piercingx.com", "piggi.descom.es", "pill-buy.com", "pillblue.com", "pillchart.com", "pillexchange.net", "pillfever.com", "pillgrowth.com", "pillhub.com", "pillhunt.com", "pillinc.com", "pillmarket.net", "pills-for-penis.com", "pillsbestbuy.com", "pillsdomain.com", "pillsking.com", "pillslim.com", "pillsupplier.com", "pilltip.com", "pimpcasino.com", "pimphos.com", "pimpspace.com", "pinkzoo.com", "piranho.com", "pisangrebus.com", "pj-city.com", "planetluck.com", "plasticmachinery.net.cn", "play-7-card-stud-poker.com", "play-7-card-stud-poker.us", "play-cash-bingo-online.com", "play-online-poker-z.com", "play-partypoker.us", "play-poker-i.com", "play-poker-onlie-kick-ass.com", "play-poker-online-z.com", "play.eu.com", "playandwin777.com", "playandwinit777.net", "player-tech.com", "playgay.biz", "playmydvd.com", "playnowpoker.com", "playweb.blogspot.com", "plygms.de", "pocketsound.org", "pok7.com", "pokemon-hentai.com", "pokemon-hentai.org", "pokemonhentai.net", "pokemonx.biz", "poker-8.com", "poker-888-e.com", "poker-e-win.com", "poker-e-wins.com", "poker-games-bonus.com", "poker-games-top-ranked.com", "poker-games.cjb.net", "poker-hands-secrets.com", "poker-homepage.com", "poker-magic.org", "poker-me-up.com", "poker-on-web.com", "poker-online-anytime.com", "poker-rooms-777", "poker-rooms-777.com", "poker-rules-easy-4u.com", "poker-tables-best-deals.com", "poker-w.com", "poker-wsop-2005.com", "poker777game", "poker79.com", "pokerorg.net", "pokerpage.biz", "pokerpartnership.com", "pokerqu.com", "pokerweb.be", "polifoniczne.org", "polyphone.us", "pompini.nu", "popwow.com", "porevo.lookin.at", "porn-4u.net", "porn-dvds-dot.com", "porn-house.us", "porn-sites-list.com", "porn-stars.org", "porn-stud-search.org", "pornevalution.com", "porngrub.com", "pornlane.com", "porno-v.com", "pornogratis.bz", "pornosexbest.com", "pornostars.cc", "pornovideos-versand.com", "pornstar4all.com", "pornwww.com", "poster-shop.us", "postersshop.us", "power-rico.de", "pregnant-sex-free.us", "prepaylegalinsurance.com", "prescription-drugs.st", "prescriptions.md", "preteen-models.biz", "preteen-sex.info", "preteen-young.net", "prettypiste.com", "princeofprussia.org", "printerinkseller.com", "prism-lupus.org", "privacy-online.biz", "private-krankenversicherung-uebersicht.com", "private-network.net", "privatediet.com", "pro-collegefootballbetting.com", "pro-rolex-replica-watches", "pro-rolex-replica-watches.com", "product-paradise.com", "projector-me.com", "prom-prepared.com", "promindandbody.com", "propecia-depot.com", "propecia-for-hair-loss.com", "propecia-for-hair-loss.net", "propecia-info.net", "propecia-store.com", "propecia.bravehost.com", "propeciaonline.biz", "propeciapower.com", "prosearchs.com", "pryporn.com", "pseudobreccia60.tripod.com.ve", "psites.biz", "psites.net", "psites.org", "psites.us", "psxtreme.com", "psychexams.net", "psychexams.org", "punksongslyrics.com", "puppyduk.com", "pureteenz.com", "pushline.com", "pussy-cum.us", "pussy-d.com", "pussy-movies.us", "qinsi.com", "qqba.com", "quangoweb.com", "quick-drugs.biz", "quick-drugs.com", "quickdomainnameregistration.com", "quickie-quotes.com", "r-300.com", "r-3100.com", "r-400.com", "r-4100.com", "r00m.com", "racconti-gay.org", "radsport-artikel.de", "raf-ranking.com", "ragazze.bz", "rampantrabbitvibrator.co.uk", "randyblue.info", "randysrealtyreview.com", "rape--stories", "rape-fantasy-pics.com", "rape-stories.biz", "rapestoriespics", "rapid-merchant-account.com", "rapid.myserver.org", "ratenkredit-center.de", "ratenkredit-shop.de", "raw-pussy.us", "rbfanz.com", "real-online-poker", "real-sex.us", "realestateslaws.com", "realisticforeignpolicy.org", "reality-xxx.biz", "reallyhot.org", "realmilfgangbang.biz", "realtickling.com", "rebjorn.co.uk", "redcentre.org", "redi.tk", "refinance-mortgage-home-equity-loan.com", "reggaeboyzfanz.com", "registerxonline.com", "registrarprice.com", "reglament-np.ru", "reisen-domain.de", "relievepain.org", "rent-games-movies.com", "rental-2004.com", "rentalcarsplus.com", "repair-restore-bad-credit-report-identity-theft.com", "repaircreditonline.net", "repondeurs-logos-mobile.com", "republika.pl", "reservedining.net", "reservedining.org", "restaurant-l.de", "rethyassociates.net", "rethyassociates.org", "reviewonlinedating.com", "rhinoslinks.com", "rhinosthumbs.com", "ricettegolose.com", "richshemales.com", "rifp.org", "rightdebt.com", "ringsignaler-ikon-spel.com", "ringtone-logo-game.com", "ringtoner-logoer-spill.com", "ringtonespy.com", "rittenhouse.ca", "rmg.com.cn", "robinson-entertainment.com", "robosapiensource", "robosapiensource.com", "roboticmilking.com", "romane-buecher.de", "romeo-ent.com", "ronnieazza.com", "rossmann.de", "roulette---online.com", "roulette-w.com", "royaladult.com", "royalfreehost.com/teen/amymiller", "royalmailhotel.com", "ru21.to", "ruitai88.com", "rulo.biz", "rx-central.net", "rx-lexapro.biz", "rx-pills-r.us", "rx-store.com", "rxpainrelief.net", "rxpills.biz", "rxweightloss.org", "rydoncycles.co.uk", "s-fuck.com", "s-sites.net", "safecreditonline.com", "sailor-moon-hentai.org", "sailor-moon-hentai.us", "salcia.co.uk", "salute-bellezza.net", "salute-bellezza.org", "salute-benessere.org", "salute-e-benessere.net", "salute-igiene.com", "salute-malattie.com", "salute-malattie.net", "samiuls.com", "sandhillaudio.com", "sandrabre.de", "sapphicerotica.biz", "sarennasworld.com", "sat-direct.net", "satellite-direct-for-you.com", "satellite-network-tv.com", "satellite-tv.cjb.net", "satellite.bravehost.com", "satellitetv-reviewed.tripod.com", "satellitetvboutique.com", "saveondentalplans.com", "saveonpills.net", "sbdforum.com", "sbt-scooter.com", "sc10.net", "scarica-mp3.biz", "scarica-mp3.com", "scarica-musica-mp3.org", "scarica-musica.com", "scarica-musica.org", "scaricamp3.us", "scaricare-canzoni.com", "scaricare-canzoni.net", "scaricare-canzoni.org", "scaricare-mp3.org", "scatporn.info", "scent-shopper.com", "schanee.de", "schmuck-domain.de", "scottneiss.net", "se-traf.com", "se24h.com", "search-1.info", "search-engine-optimization-4-us.com", "search-milf.com", "search722.com", "searchinsurance.net", "searchtypo.com", "secureroot.org", "security-result.com", "sedonaretreat.org", "seekartist.com", "seeker-milf.com", "seitensprung-gratis.com", "selectedsex.com", "selena-u.ru", "selten-angeklickt.de", "semax14.info", "semax15.info", "semax16.info", "sempo-tahoe.com", "senior.mine.nu", "seoy.com", "servepics.com", "servicesdating.net", "sesso-gratis.cc", "sesso-online.net", "sessoanalex.com", "sessox.biz", "seven-card-stud.biz", "seven-card-stud.us", "sewilla.de", "sex-4you.org", "sex-bondagenet.org", "sex-friend.info", "sex-livecam-erotik.net", "sex-lover.org", "sex-manga.us", "sex-mates.info", "sex-photos.org", "sex-pic-sex.com", "sex-pussy.us", "sex-toys-next-day.com", "sex4dollar.com", "sexadultdating.com", "sexbrides.com", "sexchat.ccx", "sexcia.com", "sexe.vc", "sexglory.com", "sexiestserver.com", "sexingitup.com", "sexmuch.com", "sexo9.com", "sexplanets.com", "sexschlucht.de", "sexshop-sexeshop.com", "sexshop.tk", "sextoysportal.com", "sextoyssexvideos.com", "sexual-shemales.com", "sexual-story.blogspot.com", "sexushost.com", "sexvoyager.com", "sexwebclub.com", "sexwebsites.com", "sexy-ass.us", "sexy-babes.us", "sexy-celebrity-photos.com", "sexy-girls.org", "sexy-lesbian.us", "sexy-pussy.us", "sexynudea.com", "sfondi--gratis.com", "sfondi-desktop-gratis.com", "shadowbaneguides.net", "shannon-e.co.uk", "shareint-store.com", "shemale-cum-tgp.com", "shemale-girls.com", "shemalesex.biz", "shemalesland.com", "shemalezhost.com", "shemalki.com", "shfx-bj.com", "shhilight.com", "shirts-t-shirts.com", "shop-opyt.com", "shop.tc", "shop24x7.net", "shopping-liste.de", "shoppingideen-xxl.de", "shoppyix.com", "showsontv.com", "sicarrow.co.uk", "silky-smooth-pussy.com", "simon-scans.com", "simple-pharmacy.com", "simplemeds.com", "simpsonowen.co.uk", "sindyhalliday.com", "sinfree.net", "site-mortgage.com", "sitesarchive.com", "siti-porno.us", "ski-resorts-guide.com", "skidman.com", "slatersdvds.co.uk", "slng.de", "slot-machines-slots.com", "slotmachinesguide.net", "slots-8.com", "slots-w.com", "slotsjockey.com", "slowdownrelax.com", "slut-wife-story.blogspot.com", "slutcities.com", "small-business-grants.biz", "smallbusinessgrants.biz", "smart-debt-consolidation-and-credit-services.com", "smartdot.com", "smartonlineshop.com", "smerfy.pl", "sms-sms-sms.org", "sms-sprueche-4fun.de", "sms-sprueche.com", "sms.pl", "smutwebsites.com", "sneakysleuth.com", "socoplan.org", "sofort-mitgewinnen.de", "sofortkredit-tipps.de", "soft-industry.com", "soft.center.prv.pl", "software-einkaufsmarkt.de", "software-linkliste.de", "software-review-center.org", "software.thedir.net", "softwaredevelopmentindia.com", "soittoaanet-logot-peli.com", "sol-web.de", "soma-cheap-soma.com", "soma-solution.com", "soma-web.com", "soma.st", "somacheap", "somaspot.com", "sommerreisen-2004.de", "sonderpreis.de.com", "sonnerie-compositeur.com", "sonnerie-hifi-sms.com", "sonnerie-logo-jeu.com", "sonnerie-logo-sonneries.com", "sonnerie-logos-sonneries.com", "sonnerie-logos.be", "sonnerie-max.com", "sonnerie-portable-composer.com", "sonnerie-portable.be", "sonnerie-sonneries-logo.com", "sonnerie-sonneries-logos.com", "sonnerie-sonneries.net", "sonnerie.net", "sonneries-gsm-sms.com", "sonneries-sonnerie-logo.com", "sonneries-sonnerie-logos.com", "sonneries.fr", "sorglos-kredit.de", "soulfulstencils.com", "southbeachdiet.us.com", "southbeachdietrecipe.biz", "spacige-domains.de", "spannende-spiele.de", "spassmaker.de", "speedsurf.to", "speedy-insurance-quotes.com", "spermincreasingpills.com", "spiele-kostenlose.com", "spiele-planet.com", "spoodles.com", "sportartikel-auswahl.de", "sportecdigital.com", "sportingcolors.org", "sportlich-chic.de", "sports---betting.com", "sports-betting-", "sports-betting-a.com", "sports-inter-action.com", "sportsbettingexpert.com", "sportsorg.biz", "sportsparent.com", "spp-net.de", "spy-patrol.com", "spyshots.bpa.nu", "spyware-links.com", "staffordshires.net", "staplethis.de", "starpills.com", "statusforsale.de", "steelstockholder.co.uk", "stellenangebote-checken.de", "stellenangebote-l.de", "stevespoliceequipment.com", "stfc-isc.org", "sting.cc", "stmaryonline.org", "stock-power.com", "stolb.net", "stop-depression.com", "stop-snoring.crpublish.com", "stopp-hier.de", "stopthatfilthyhabit.com", "stories--archive.com", "stories-adult.net", "stories-inc.com", "stories-on-cd.net", "stories-on-cd.org", "storiespics", "storiespics.game-host.org", "storiespics.game-server.cc", "storiespics.gotdns.com", "storiespics.gotdns.org", "storiespics.ham-radio-op.net", "storiespics.homedns.org", "storiespics.homeftp.net", "storiespics.homeftp.org", "storiespics.homeip.net", "storiespics.homelinux.com", "storiespics.homelinux.net", "storiespics.homelinux.org", "storiespics.homeunix.com", "storiespics.homeunix.net", "storiespics.homeunix.org", "striemline.de", "stripclubexposed.info", "strivectinsd.com", "stunningsextoys.com", "styrax-benzoin.com", "success-biz-replica.com", "suma-eintragen.de", "sumaeintrag-xxl.de", "sunbandits.com", "sunnyby.com", "suonerie-center.com", "suonerie-download.com", "suonerie-loghi-gratis.com", "suonerieloghix.com", "suoneriex.net", "suoyan.com", "super-bowl-bet.biz", "super-celebs.com", "super-cialis.com", "superbowl--betting.com", "superdolphins.org", "superpornlist.com", "surfe-und-staune.de", "susiewildin.com", "sutra-sex.com", "suttonjames.net", "suttonjames.org", "svitonline.com", "swedenet.com", "swedenetwork.com", "sweet-horny.com", "sweetbuyz.com", "sweethotgirls.com", "sweetteenbodies.com", "swinger-story.blogspot.com", "swingersadult.net", "swingersunidos.com", "sydney-harbour.info", "sylphiel.org", "sylviapanda.com", "sysaud.com", "t35.com", "t3n.org", "tabsinc.com", "take-credit-cards.com", "taliesinfellows.org", "talktobabes.com", "tanganyikan-cichlids.co.uk", "tapbuster.co.uk", "taremociecall.com", "targetindustries.net", "targetingpain.net", "tattoo-entwuerfe.de", "tatuaggi-gratis.com", "tatuaggi-piercing.org", "tatuaggi-tribali.com", "tatuaggi.cc", "tatuaggi.us", "tatuaggitribali.com", "tclighting.net", "tclighting.org", "tdk-n.com", "teambeck.org", "teamregules.com", "tecrep-inc.net", "tecrep-inc.org", "teddbot.com", "teddnetwork.com", "teen-babes.us", "teen-boys-fuck-paysite.com", "teen-d.com", "teen-hentai.us", "teen-movie.us", "teen-porn-movie.net", "teen-sex-porn-models.com", "teen-video.us", "teen-xxx.us", "teenagerzone.com", "teenbrazil.info", "teenbrazil.ws", "teens.wox.org", "teensluts.org", "teentopanga.name", "teenxxxpix.net", "telechargement-logiciel.com", "terminator-sales.com", "terra.es/personal2/dee7boquo", "terra.es/personal2/markus69", "testi-canzoni.com", "testi-canzoni.net", "testi-musicali.com", "testi-musicali.net", "testi.cc", "tests-shop.com", "tette.bz", "tettone.cc", "texas--hold--em", "texas--hold-em", "texas--holdem", "texas-hold-em", "texas-holdem", "texas-poker", "texasproptax.com", "tgplist.us", "thatwhichis.com", "the-boys-first-time.net", "the-boysfirsttime.com", "the-date.com", "the-first-time-auditions", "the-hun-site.com", "the-hun-yellow-page-tgp.com", "the-pill-bottle.com", "the-proxy.com", "the1930shome.co.uk", "thebans.com", "theblackfoxes.com", "theceleb.com", "thecraftersgallery.com", "thefreecellphone.com", "thehadhams.net", "themadpiper.net", "thepornhost.com", "thepurplepitch.com", "therosygarden.com", "thesoftwaregarage.co.uk", "thespecialweb.com", "thewebbrains.com", "thorcarlson.com", "thumbscape.com", "ticket-marktplatz.de", "tickets4events.de", "tiere-futter.de", "tiffany-towers.com", "tigerspice.com", "tikattack.com", "timescooter.com", "tina4re.com", "tips-1a.de", "tits-center.com", "tits-cumshots.net", "tm258.com", "tmsathai.org", "tofik.pl", "tokyojoes.info", "tonos-celulares.com.mx", "tonos-nokia.com.mx", "top-blackjack-game", "top-blackjack.net", "top-casinos-net.com", "top-cialis.com", "top-deals-online-pharmacy", "top-deals-pills", "top-deals-pills.info", "top-dedicated-servers.com", "top-des-rencontres.com", "top-fioricet.com", "top-internet-blackjack.com", "top-milf.com", "top-of-best.de", "top-online-poker-bonuses", "top-online-slots.com", "top-pharmacy.net", "top-poker-21.com", "top-sex-base.com", "top-skelaxin.com", "top-soma.com", "top-the-best.de", "top-video-poker.info", "top-wins-2005.com", "topaktuelle-tattos.de", "topcialis.com", "topmeds.net", "toques-logos-jogos.com", "toshain.com", "total-verspielt.de", "totallyfreecreditreport.org", "touchwoodmagazine.org.uk", "tournamentpoker.biz", "training-one.co.uk", "trannies.angelcities.com", "tranny-pic-free.com", "tranny-sex-clips.com", "tranny.150m.com", "trannys.blowsearch.ws", "trannysexmovie.com", "transbestporn.com", "transestore.com", "transpire.de", "traum-pcs.de", "treocat.com", "triadindustries.co.uk", "trixieteen.org", "troggen.de", "troie.bz", "trolliges.de", "trucchi-giochi.us", "trueuninstall.com", "trumpetmission.org", "tt33tt.com", "tt7.org", "tubegator.com", "tuff-enuff.fnpsites.com", "turist.com.pl", "tvforum.org", "twinky.org", "tygef.org", "u-w-m.ru", "uaeecommerce.com", "ufosearch.net", "uk-virtual-office-solutions.com", "uk.net", "ukrainewife.net", "ultra-shop.info", "ultracet-web.com", "ultrampharmacy.com", "unbeatablecellphones.com", "unbeatablemobiles.co.uk", "unbeatablerx.com", "unccd.ch", "underage-pussy.net", "undonet.com", "uni-card.ru", "united-cash.com", "unitedarchive.com", "unrisd.com", "unscramble.de", "unterm-rock.us", "upsms.de", "urlaubssonne-tanken.de", "us-cash.com", "us-meds.com", "usa-birthday-flowers.com", "usa-car-insurance.com", "usa-car-loans.com", "usa-cash-advance.com", "usa-escorts-123.com", "usbitches.com", "uscashloan.com", "usedcarsforsale", "v27.net", "v29.net", "v3.be", "vacation-rentals-guide.com", "valeofglamorganconservatives.org", "vcialis.com", "venera-agency.com", "veranstaltungs-tickets.de", "vergleich-versicherungsangebote.de", "versicherungsangebote-vergleichen.de", "versicherungsvergleiche-xxl.de", "versteigerungs-festival.de", "verybrowse.com", "verycd.com", "verycheapdentalinsurance.com", "viaggix.com", "viapaxton.com", "video-n.com", "video-poker", "video-poker-dot.com", "video-poker-world.net", "video-porno.nu", "videohentai.org", "videoportfolios.com", "vilentium.de", "villagesx.com", "vimax.lx.ro", "vimax.topcities.com", "vip-condom.com", "vip-online-pharmacy.com", "vitamins-for-each.com", "vivalatinmag.com", "vivlart.com", "vixensisland.com", "vladgorlum.gotdns.com", "vladstepanov.brunst.dk", "vod-solutions.com", "voiphone.cn", "vonormytexas.us", "vpmt.com", "vpshs.com", "vrajitor.com", "vtsae.org", "w-ebony.com", "w5.pl", "wake.rlights.com", "waldner-msa.co.uk", "wancheng.cn", "warblog.net", "washere.de", "watches-sales.com", "waterbeds-dot.com", "wayshell.co.uk", "wblogs.com", "wcgaaa.org", "we-live-together-4u.com", "weareconfused.org.uk", "wearethechampions.com", "web-aks.com", "web-cam-101.com", "web-cam-porn.net", "web-cialis.com", "web-revenue.com", "webanfragen.de", "webblogs.biz", "webcam-erotiche.com", "webcenter.pl", "webcindario.com", "webcopywizard.net", "webhgh.com", "webpark.pl", "webrank.cn", "websitedesigningpromotion.com", "weddings-info.com", "weddings-links.com", "weekend-cialis", "weighlessrx.com", "weight-loss-central.org", "weight-loss-links.net", "weightlossplace.net", "weitere-stellenangebote.de", "wellness-getraenk.de", "wet-4all.com", "wet-pantie.net", "wet-pussy.us", "wethorny.com", "whackingpud.com", "white-shadow-nasty-story.blogspot.com", "whitehouse.com", "whizzkidsuk.co.uk", "wholesalepocketbike.com", "wild-porno-girls.com", "willcommen.de", "win-in-poker.com", "wincmd.ru", "wincrestal.com", "windcomesdown.com", "wirenorth.com", "wiset-online.com", "wisskie.cx", "witch-watch.com", "witz-net.de", "wizardsoul.com", "woodyracing.co.uk", "workfromhome-homebasedbusiness.com", "world-candle.com", "world-cheese.com", "world-series-of-poker-1996.com", "worldmusic.com", "worldsexi.com", "worldwide-deals.net", "worldwide-games.net", "worldwide-holdem.com", "worldwide-online-pharmacy.net", "worldwide-sources.com", "worldwidecasinosearch.com", "wotcher.de", "www-sesso", "www-webspace.de", "x-baccarat.com", "x-baccarat.us", "x-beat.com", "x-bingo.com", "x-craps.com", "x-craps.us", "x-fioricet.com", "x-free-casino-games.com", "x-internet-casino.com", "x-jack.us", "x-pictures.net", "x-pictures.org", "x-ring-tones.com", "x-ringtones.com", "x-roulette.com", "x-roulette.us", "x-roullete.com", "x-slots.com", "x-slots.us", "x-stories.org", "x-video-poker.com", "x-video-poker.us", "xadulthosting.com", "xadultpersonals.com", "xaper.com", "xdolar.com", "xfreehosting.com", "xgsm.org", "xgsmhlhc.com", "xin-web.de", "xingzhiye.com", "xlboobs.net", "xmilf.us", "xmix.net", "xnxxx.com", "xpictx.com", "xprescription.com", "xprv.com", "xrated-midgets.com", "xratedcities.com", "xsesso.biz", "xxshopadult.com", "xxuz.com", "xxx-alt-sex-story.blogspot.com", "xxx-database.com", "xxx-dvd.biz", "xxx-erotic-sex-story.blogspot.com", "xxx-first-time-sex-story.blogspot.com", "xxx-free-erotic-sex-story.blogspot.com", "xxx-gay-sex-story.blogspot.com", "xxx-girls-sex.com", "xxx-password-web.com", "xxx-pussy.us", "xxx-sex-movies.org", "xxx-sex-story-post.blogspot.com", "xxx-spanking-story.blogspot.com", "xxx-stories.net", "xxx-story.blogspot.com", "xxxchan.com", "xxxseeker.com", "xxxwashington.com", "xz9.com", "yaboo.dk", "yaninediaz.com", "ybuano.org", "yellowmonkey.com", "yellowmonkey2.com", "yellowmonkey55.com", "yelucie.com", "yisosky.vip.sina.com", "ymf.name", "yoga-mats.freeservers.com", "yoll.net", "you-date.com", "young-ass.us", "your-tattoo.de", "yourcialis.info", "yourdentalinsuranceonline.com", "yourowncolours.co.uk", "yourserver.com", "ypoker.net", "yubatech.com", "yukka.inc.ru", "zalaszentgrot.com", "zaotao.com", "zazlibrary.com", "zenno.info", "zfgfz.net", "zipcodedownload.com", "zipcodesmap.com", "zithromax-online.net", "zj.com", "zone-b51.com", "zoo-sex-pics.com", "zoo-sex.biz", "zoo-sex.info", "zoo-zone.com", "zooeurope.com", "zoofil.com", "zoofilia-fotos.com", "zoomaniz.flnet.org", "zoosex-motion-videos.com", "zoosex-pictures.com", "zoosx.net", "zpics.net", "zt148.com", "zum-bestpreis.de", "zweree.com", "zxyzxy.com", "anal-sex", "gambiling-online", "gambling-online", "mc.ashgabad.su", "smokersteeth.com", "ibizatopless.com", "holdem-poker.us.gg", "hotelgaydays.com", "lenarcic.org", "poker4spain.com", "vneighbor.com", }; visitors_0.7/build-tar-gz.sh0100755000175000017500000000055610412774745016120 0ustar antirezantirez#!/bin/sh if [ -z $1 ] then VER="current" else VER=${1} fi make clean rm -rf releases/visitors_${VER} mkdir -p releases/visitors_${VER} 2> /dev/null cp * releases/visitors_${VER} # Better to don't compress the man page for Debian developers easy fix. # gzip -9 releases/visitors_${VER}/visitors.1 cd releases tar cvzf visitors-${VER}.tar.gz visitors_${VER} cd .. visitors_0.7/doc.html0100644000175000017500000005412010412774745014707 0ustar antirezantirez Visitors - fast web log analyzer
VISI TORS
Visitors, on line documentation for 0.7
(click here for the home page)
Table of Contents

Name

visitors - a fast web server log analyzer

Synopsis

visitors [options] <filename> [<filename> ...]

Description

Visitors generates access statistics from specified web log files.

The resulting reports contain a number of useful informations and statistics:

Requested pages
Requested images
Referers by number of visits and age
Unique visitors in each day
Page views per visit
Pages accessed by the Google crawler (and the date of google's last access on every page)
Pages accessed by the AdSense crawler (and the date of adsense's last access on every page)
Percentage of visits originated from Google searches for every day
User navigation patterns (web trails)
Keyphrases used in Google searches
Human languages used in google searches
User agents
Weekdays and Hours distributions of accesses
Weekdays/Hours combined bidimensional map
Month/Day combined bidimensional map
Visual path analysis with Graphviz
Operating systems, browsers and domains popularity
Visitors screen resolution and color depth
404 errors

The web log files don't need to follow a strict format, except: the date MUST be included between [ and ] chars, the client hostname MUST be the first entry in the log, referers and requests MUST be included between double quote chars. Out of the box Apache log file will work without problems.

It's possible to use Visitors with IIS log files converting them using the iis2apache.pl utility distributed with Visitors (The utility is the same you can find at http://www.jammed.com/~jwa/hacks/ and is distributed under the GPL license).

Note that logfile can be a - character to use the standard input.

Available options:

-A --all
Activate all the optional reports. This option is equivalent to -GKUWRDOB. Note that --trails is not implicitly included in this option because it also requires --prefix. See the --trails option documentation for details.

-T --trails
Enable the Web Trails feature. The report will show what are the more frequent moves between pages of your site. This option requires the --prefix option to work.

-G --google
Activate two reports about pages accessed by the Google and Adsense web crawlers. Pages are shown ordered accordingly to the last time the Google web crawler requested the page. The first page shown is the latest that was accessed.

-K --google-keyphrases
Activate a report that shows common search keyphrases used to found your web site from Google.

-Z --google-keyphrases-age
Activate a report that shows common the lastest keyphrases used to found your site from Google.

-H --google-human-language
Activate a report that shows common human languages used to serach from Google. This feature uses the 'hl' variable of the Google referer URL.

-U --user-agents
Show information about common user agents.

-W --weekday-hour-map
Activate the generation of a combined weekdays/hours bidimensional map that shows information about traffic in every 168 different hours of a 7 days week. Brighter colors mean higher traffic. This is ideal to figure what's the best moment on a week for a maintenance downtime, what's the target of the site, if people are accessing it from work or from home, and so on. The map is generated as pure html inside the report.

-M --month-day-map
Activate the generation of a combined month/day bidimensional map that shows information about traffic in every 365 different days of the year. Brighter colors mean higher traffic. This is useful in order to figure with a quick look traffic trends and days with particuarly high or low traffic. The map is generated as pure html inside the report.

-R --referers-age
Shows referers ordered by age. The 'age' of a referer is the date it appeared the first time. In the report, newer referers are on top. This report is useful to check for new external links.

-D --domains
Activate the generation of information about Top Level Domains popularity. This information may be useful to guess the amount of visits from different countries. Note that Visitors will not resolve numerical IP addresses if they are not already resolved in the log file. All the unresolved IP addresses will be shown in this report under the entry Unresolved IP.

-O --operating-systems
Activate the report about Operating Systems popularity, sorted by number of accesses. All the common operating systems are listed in the report, while unknown operating systems will be summed in the unknown entry.

-B --browsers
Activate the report about Browsers popularity, sorted by number of accesses. All the common browsers are listed in the report, while unknown browsers will be summed in the unknown entry. Browsers are listed by family (for example Internet Explorer, Opera, and so on), and not by specific version.

-X --error404
Activate the generation of missing documents (404 error) report. This report will show files requested, but missing, ordered by number of requests. The report is useful in order to discover if for some mistake there is some file missing in the web site, but often you will see bizarre requests performed by users or internet worms and security scans.

-Y --pageviews
Activate the generation of a report that shows (and approximation) of the percentage of pages viewed per unique visit. The goal of this report is to understand the usage pattern of the site and the level of interest of the visitors. For example, in a site that provides a number of pages with interesting contents, the percentage of visitors performing a single page view per visit is probably searching for something else.

-S --robots
Activate the generation of a report that shows user agents of clients requesting the file robots.txt, with the exception of the MSIE Crawler requests. The result is a list of web robots and spieders that accessed your web site, ordered by number of requests of robots.txt.

--screen-info
Activate the screen resolution and color depth reports. Note that for this report to work you have to insert on your HTML pages the javascript code you can find in the README file in the visitors tarball.

--stream
Enable the Stream Mode (see the STREAM MODE DETAILS section for more information). Shortly: when in stream mode Visitors will process all the log files specified (possibly none, that's valid in this mode) as usual, producing the report. Then the stream mode is entered and Visitors will start to read from standard input for a continuous stream of web logs, updating the statistics incrementally as new data is available. A new report is produced periodically if new data arrived, accordingly to the --update-every option (default is to update the statistics every ten minutes). It's possible to ask Visitors to reset the statistics after some period of time using the --reset-every option. This allows to have a snapshot of what is going on in the last five minutes, hour, day or week. Note that --stream requires --output-file because Visitors needs to overwrite the report for every update, so can't output to standard output as usually. If you plan to use the stream mode, also check the --tail option.

--update-every seconds
By default in Stream Mode statistics are updated every 10 minutes. This option specifies a different period in seconds.

--reset-every seconds
By default in Stream Mode statistics are never reset, but continuously updated incrementally. This option specifies to reset statistics after the given amount of time in seconds. This is useful to have a snapshot of the web site usage.

-f --output-file file
Write output to file instead of stdout.

-m --max-lines number
Set the max number of entries that should be shown in reports like referers, keyphrases and so on. This option sets all the reports max number of entries for all the reports at once.

-r --max-referers number
Set the max number of entries in the referer report.

-p --max-pages number
Set the max number of entries in the accessed pages report.

-i --max-images number
Set the max number of entries in the accessed images report.

-x --max-error404 number
Set the max number of entries in the missing documents report.

-u --max-useragents number
Set the max number of entries in the user agents report.

-t --max-trails number
Set the max number of entries in the web trails report.

-g --max-googled number
Set the max number of entries in the crawled pages report (google bot).

--max-adsensed number
Set the max number of entries in the crawled pages report (adsense bot).

-k --max-google-keyphrases number
Set the max number of entries in the Google keyphrases report.

-a --max-referers-age number
Set the max number of entries in the referers by date report.

-d --max-domains number
Set the max number of entries in the domains report.

-P --prefix number
Prefixes specify to visitors how a link should look like to be classified as internal to your site. This option is required for --trails and will also have the nice effect to avoid that internal links are shown in the referers report. If you are analyzing statistics for http://www.your.site.com/, just use: --prefix

http://www.your.site.com

If your site is reachable using more hostnames you should specify all these, like in the following example:
--prefix http://www.your.site.com --prefix http://your.site.com

-o --output html|text
Output module. You can use text or html. The default is html.

-V --graphviz
This option enables the Graphviz mode: Visitors will analyze the log file and create a graph describing the access patterns of your web site. The information used to create the graph is the same as the web trails report (that you can enable with --trails), but as a graph it can be more readable for non trivial sites. An example on how to use this feature:

% visitors access.log --prefix http://www.hping.org --graphviz > graph.dot

% dot /tmp/graph.dot -Tpng > graph.png

On Debian systems, the dot command is included in the graphviz package. The generated graph will have edges of different colors, from blue to red to specify a low to high level of popularity of a given movement from one page to another of the web site. This option requires one or more --prefix options in order to work, just like the --trails option.

-V --graphviz-ignorenode-google
Don't put the google node on the generated graph. Only useful with --trails

-V --graphviz-ignorenode-external
Don't put the external referer node on the generated graph. Only useful with --trails

-V --graphviz-ignorenode-noreferer
Don't put the node indicating requests without referer on the generated graph. Only useful with --trails

--tail
When this option is specified Visitors will emulate the Unix command tail -f --max-unchanged-stats=1 -q. You can specify the log file names to monitor for changes, once new data is appended in any of the specified file, visitors will output the new data to the standard output. This option is useful conjunction to the Stream Mode (--stream). Files can be log-rotated because Visitors in Tail Mode will always try to reopen the file to check for changes.

--time-delta delta
If your web server is in a different timezone than most of your visitors or yourself, you will notice a shift in the reports regarding time and days of week. By default, Visitors will generate output using the host's locale. You can use the --time-delta option in order to adjust the output. Positive values will shift on the right (toward future) from the given number of hours, negative values will shift on the left (toward past). In the future this option may have support to directly specify the output timezone.

--filter-spam
Filter referer spam using a keyword-based filter (see blacklist.h for more information on keywords). If you don't know what referer spam is check this Wikipedia page: http://en.wikipedia.org/wiki/Referer_spam

--ignore-404
When this option is turned on log lines with 404 errors are just used to generate the 404 errors report and not used for other reports.

--grep pattern
Process only log lines matching the specified pattern. Patterns are matched using the glob-style matching (the one used by the unix shell):
*
Matches any sequence of characters in string, including a null string.
?
Matches any single character in string.
[chars]
Matches any character in the set given by chars. If a sequence of the form x-y appears in chars, then any character between x and y, inclusive, will match.
\x
Matches the single character x. This provides a way of avoiding the special interpretation of the characters *?[]\ in pattern.
For default matching is performed in a case sensitive way, but case insensitive matching may be forced prefixing the pattern with the string cs:, so for example the pattern cs:firefox will match all the log lines containing the string firefox, FireFox, FIREFOX and so on.

--exclude pattern
Works exactly like --grep, but only lines NOT matching the specified pattern are processed. Note that --grep and --exclude can be used multiple times, and are processed sequentially. For example visitors --grep firefox --exclude download will process only lines including the string firefox but not including the string download.

--debug
Show additional information on errors. For example invalid lines are printed on the standard error if found. Mainly useful for developers and error reporting.

-h --help
Show usage and copyright information.

-v --version
Show program version.

Examples

The simplest usage, to be used interactively when you have a web log to check (for example over ssh in your web server), just use:

% visitors access.log | less

That will produce a human readable output in text only. To generate html web stats with much more information you may use instead this:

% visitors --output text -A -m 30 access.log -o html > report.html

If you want information on the usage patterns for your site you must provide the url prefix of your web site, and specify the --trails option. The next example produces an HTML report with usage patterns information.

% visitors -A -m 30 access.log --trails --prefix http://www.hping.org > report.html

Note that it's ok to specify multiple file names, or to provide the input using the standard input like in the following two examples:

% visitors /var/log/apache/access.log.*
% zcat access.log.*.gz | visitors -

Stream Mode Details

The usual way to run Visitors is to specify some option to control the report generation, and the name of log files. For example to generate a report from two Apache's access log files you can write:

% visitors -A access.log.1 access.log.2 > report.html

Visitors will analyze the log files, and will output the report. Sometimes it can be more interesting to have web statistics updated continuously, almost in real time, as new data is available. In order to provide this feature Visitors implements a mode called Stream Mode that reads a stream of logs from the standard input. The following command line shows how to use it (but check the --stream option documentation for more information).

% tail -f /var/log/apache/access.log | visitors --stream -A --update-every 60 \
--output-file /tmp/report.html

Visitors will incrementally update the statistics as new logs are available and will update the html report every 60 seconds. As you can see in this mode is required to specify the report file name using the --output-file option because Visitors needs to overwrite the report to update it. Note that instead of the tail command in the above example it is possible to use instead Visitors in Tail Mode (an emulation for the tail program):

% visitors --tail /var/log/apache/access.log | visitors --stream -A --update-every 60 \
--output-file /tmp/report.html

It's possible to generate real time statistics about the last N seconds of web traffic, where N is configurable and can be from few seconds to one week or more, using the --reset-every option. The following example generates statistics updated every 30 seconds about the last hour of traffic:

% visitors --tail /var/log/apache/access.log | visitors --stream -A --update-every 30 --reset-every 3600 \
--output-file /tmp/report.html

Authors

Visitors was written by Salvatore Sanfilippo <antirez@invece.org>.

Copying

Copyright (C) 2004,2005 Salvatore Sanfilippo <antirez@invece.org>.

Visitors is distributed under the GNU General Public License.

This manual page was written (based on the original HTML documentation) by Romain Francoise <rfrancoise@debian.org> for the Debian GNU/Linux system, but may be used by others. Salvatore Sanfilippo updated this man page starting from Visitors 0.5, this manual page is now part of the Visitors tarball.

Table of Contents

Copyright (C) 2005 Salvatore Sanfilippo -- All Rights Reserved

Google
visitors_0.7/iis2apache.pl0100755000175000017500000000636110412774745015630 0ustar antirezantirez#!/usr/bin/perl # # Use this tool to convert IIS logs into NCSA format that # Visitors will be able to handle. # # make an IIS log look strikingly like an apache log # we make a vague attempt to interpret the Fields: header # in an IIS logfile and use that to make IIS fields match up # with apache fields. # # Copyright jwa@jammed.com 12 Dec 2000 # # This software is released under the GPL license # as specified in the home page: http://www.jammed.com/~jwa/hacks/ while ($arg = shift @ARGV) { $tzoffset = shift @ARGV if ($arg eq "--faketz"); $vhost = shift @ARGV if ($arg eq "--vhost"); $debug = 1 if ($arg eq "--debug"); # show field interpretation } if ($tzoffset eq "") { print STDERR "Will use -0000 as a fake tzoffset\n"; $tzoffset = "-0000"; } # build month hash @m = ('Jan','Feb','Mar','Apr','May','Jun','Jul','Aug','Sep','Oct','Nov','Dec'); while ($m = shift @m) { $month{++$n} = $m; } # an IIS log adheres to what's defined by 'Fields;' # attempt to parse this, tagging LINE: while ($line = ) { $line =~ s/\r|\n//g; # cooky DOS format if ($line =~ /^#Fields: /) { @line = split(" ", $line); shift @line; # shifts of #Fields # build a hash so we can look up a fieldname and # have it return a position in the string undef %fieldh; $n = 0; # zero-based array for split while ($l = shift @line) { $fieldh{$l} = $n++; print STDERR "$l is position $fieldh{$l}\n" if ($debug); } } next LINE if ($line =~ /^#/); #Fields: date time c-ip cs-username s-sitename s-computername s-ip cs-method cs- #uri-stem cs-uri-query sc-status sc-win32-status sc-bytes cs-bytes time-taken #s-port cs-version cs(User-Agent) cs(Cookie) cs(Referer) # this is really slow. $date = yankfield("date"); $time = yankfield("time"); $ip = yankfield("c-ip"); $username = yankfield("cs-username"); $method = yankfield("cs-method"); $stem = yankfield("cs-uri-stem"); $query = yankfield("cs-uri-query"); $status = yankfield("sc-status"); #$bytes = yankfield("cs-bytes"); # Which is it? sc-bytes or cs-bytes? # cs-bytes only appears in some of the IIS logs I've seen. # I'll assume that sc-bytes is "server->client bytes", which # is what we want anyway. $bytes = yankfield("sc-bytes"); # I'm gonna go with this. $useragent = yankfield("cs(User-Agent)"); $referer = yankfield("cs(Referer)"); $useragent =~ s/\+/\ /g; # our modified CLF sez: # IP - - [DD/MMM/YYYY:HH:MM:SS TZOFFSET] "method stem[?query]" status bytes "referer" "user agent" "vhost" # convert date # 2000-07-19 00:00:01 ($y, $m, $d) = split("-", $date); $m =~ s/^0//g; $mname = $month{$m}; # build url $url = $stem; if ($query ne "-") { $url .= "?$query"; } # all done, print it out print "$ip - - [${d}/${mname}/${y}:${time} ${tzoffset}] \"$method $url\" $status $bytes \"$referer\" \"$useragent\" \"${vhost}\"\n"; } # return the proper field, or "-" if it's not defined. # (unfortunately ($date) = (split(" ", $line))[$fieldh{date}]; # will return element 0 if $fieldh{date} is undefined . . .) sub yankfield { my ($field) = shift @_; print STDERR "Looking at $field; position [$fieldh{$field}]\n" if ($debug); if ($fieldh{$field} ne "") { return (split(" ", $line))[$fieldh{$field}]; } else { print STDERR "$field undefined\n" if ($debug); return "-"; } } visitors_0.7/powered-by-visitors.png0100644000175000017500000001272610412774745017725 0ustar antirezantirezPNG  IHDRZ$ -bKGD pHYs  tIME  .tEXtCommentWilber was done with The Gimp! /tigertp=)IDATx͚{p\}?{w,_(QCZ"%QJNꎪpdI3MN,y:&xZ3vlwMcWQʵG%JD)>@vž􏻻K3wΞ;GD 8x=;7v̻=۶nz\v!mY/T(Φ|v.ّ~mK_>XۮNv𫷮_.sX/ҽccb[mtsɾuwlݽ;顥 #4c[ssz1crqf+G~8qe8gμ;rUo$dȥ#Q\g`/e#J)ָmYh0 xRKY>7K_d~R(2@anߧӏ( o'X>G{JT8~s8 m# qpl)H!%e!qJ˲})%RJ0-AP`qqblm?wP(|ij:3}mq]CCC۷n.2 9rx<ku]|' m88EPJmxx˗/s7&Ns ?gғ7]7ol9}})#a-\cZZ*e;'_'lюcaYR|cl _W ?J8|0w4&imb6JRD\X,R%|~ N8?̣>JGGǏ Fm… ;v399I:&Fs1 M($i(Dx;Lͤ\8a~Tv"bqy|u1C6Ŷm>Nx7We| DؿT*AD2L{I4j1hiQH)f(%1 Q*+\dr3yKyhmda``~-)JJEZ[0LEJE@mvu֖h1*FU8Ο]Iq oݖɔm}r #yt _R#|O:/aw=kzm[b2f0gw(]a˓LU(8yEoq;\it[n/wO15gxl' %5n*rzz\ߣʧ65a#KW߉oGes eɁJ|"έ)J%vp{Yulte NI)ka}mr7$3Rx"Ggqaz?JWfB|J©8tl?6޴Sq<8^829c'.n~Oz|v:[X5xuD+\ӝ lb,bOޓE^{`6Qʳ֋ɀ Dr]6'i+ b-y;_MyC[%7M 4fB x@IHIMC>Pn(o~Vx-|"!ֈ㯎qb`S\O02f !:@x Yg.U...bU&ImzˑLZq,{h-0 H%= Ex"&X,/[PޤB'.biQ};So3<|b)6mQIj|ddWڕ&56NO[;QOJYЩzDVšwW4U}c}%bYEJ0MX,w H$ضՔ^4zD{Q>Yꆜ/[)U Lnfz)όƵ 8RJuj~t-8vux Ry"HCU#HjHgFGǘa߾'Nqؿ?J&kGc21e\;(kWχQʣḁR8 tvncffTrDKKl6K2PX"ia~~vytt$dfioo%BPuH$P*ʀ.xBH"A>D, Zz5kn̐kAVQax2W?| g}1(䩧⡇ʕaٳgo9r7||>O{{;rc% 155 /|[]_nŚfsV m۶188Doo/ΝٳsNy<ٳ200Ν;ٱcwyW2D"l۶]vqmi&Ο?hկ4.޽SNݤ*޳L$:^[l_;0F۶UjXV?Rqaz{Stwwg^zzzٹZvE6u=6oBoo/Tm۶3??֚;vb۷oX,F<'Ho>'9t0?jkﳸ8G.X,"*K/..P(fkoL3d2i~RG=lzpwWSZ8/_bx"35]UqYb^w]IIJrﵷö+4sk}zJ JOem w U\|_c8M>FF.Q(`!4J(U^Jm"$AZ{"j)u2XVv}!TLld|p@ujsu6033 #define vi_sleep(x) Sleep((x)*1000) #else #include #define vi_sleep(x) sleep(x) #endif #endif /* __VI_SLEEP_H */ visitors_0.7/tail.c0100644000175000017500000000377710412774745014365 0ustar antirezantirez#include #include #include #include "sleep.h" /* Open a file, seek at the end, and store in '*len' the file length */ static FILE *vi_openAtEnd(char *filename, long *len) { FILE *fp = NULL; if ((fp = fopen(filename, "rb")) == NULL) goto err; /* open */ if ((fseek(fp, 0, SEEK_END)) == -1) goto err; /* seek at end */ if ((*len = ftell(fp)) == -1) goto err; /* read the file length */ return fp; err: if (fp != NULL) fclose(fp); return NULL; } /* Output 'len' bytes of file 'fp' starting from 'offset'. * The function returns 0 on success, -1 on error. */ #define TAILOUT_BUFLEN 1024 static int vi_tailOutput(FILE *fp, long offset, long len) { char buf[TAILOUT_BUFLEN]; if (fseek(fp, offset, SEEK_SET) == -1) return -1; while(len) { unsigned int min = (len > TAILOUT_BUFLEN) ? TAILOUT_BUFLEN : len; if (fread(buf, 1, min, fp) != min) return -1; fwrite(buf, 1, min, stdout); fflush(stdout); len -= min; } return 0; } /* An interation for the 'tail -f' simulation. Open the * file at every iteration in order to continue to work * when files are rotated. */ static void vi_tailIteration(char *filename, long *len) { long newlen, datalen; FILE *fp = NULL; fp = vi_openAtEnd(filename, &newlen); if (fp != NULL) { if (*len == -1) { /* Initialization */ *len = newlen; } else if (newlen < *len) { /* Shorter file condition */ *len = 0; /* the next iteration will read the new data */ } else if (newlen > *len) { /* Data ready condition */ datalen = newlen - *len; if (vi_tailOutput(fp, *len, datalen) != -1) *len = newlen; } } if (fp != NULL) fclose(fp); } void vi_tail(int filec, char **filev) { long *len; int i; if (filec <= 0) { fprintf(stderr, "No files specified in tail-mode\n"); exit(1); } len = malloc(filec); if (!len) { fprintf(stderr, "Out of memory\n"); exit(1); } for (i = 0; i < filec; i++) len[i] = -1; while(1) { for (i = 0; i < filec; i++) vi_tailIteration(filev[i], &len[i]); vi_sleep(1); } } visitors_0.7/visitors.10100644000175000017500000004340510412774745015224 0ustar antirezantirez.TH VISITORS "1" "April 2005" "Visitors 0.7" .SH NAME visitors \- a fast web server log analyzer .SH SYNOPSIS .B visitors [\fIoptions] \fI [\fI ...] .SH DESCRIPTION .PP .I Visitors generates access statistics from specified web log files. The resulting reports contain a number of useful informations and statistics: .IP \[bu] 2 Requested pages .IP \[bu] Requested images .IP \[bu] Referers by number of visits and age .IP \[bu] Unique visitors in each day .IP \[bu] Page views per visit .IP \[bu] Pages accessed by the Google crawler (and the date of google's last access on every page) .IP \[bu] Pages accessed by the AdSense crawler (and the date of adsense's last access on every page) .IP \[bu] Percentage of visits originated from Google searches for every day .IP \[bu] User navigation patterns (web trails) .IP \[bu] Keyphrases used in Google searches .IP \[bu] Human languages used in google searches .IP \[bu] User agents .IP \[bu] Weekdays and Hours distributions of accesses .IP \[bu] Weekdays/Hours combined bidimensional map .IP \[bu] Month/Day combined bidimensional map .IP \[bu] Visual path analysis with Graphviz .IP \[bu] Operating systems, browsers and domains popularity .IP \[bu] Visitors screen resolution and color depth .IP \[bu] 404 errors .PP The web log files don't need to follow a strict format, except: the date MUST be included between [ and ] chars, the client hostname MUST be the first entry in the log, referers and requests MUST be included between double quote chars. Out of the box Apache log file will work without problems. It's possible to use Visitors with IIS log files converting them using the iis2apache.pl utility distributed with Visitors (The utility is the same you can find at http://www.jammed.com/~jwa/hacks/ and is distributed under the GPL license). Note that logfile can be a \- character to use the standard input. .PP .SS "Available options:" .TP 8 .BI "\-A \-\-all" Activate all the optional reports. This option is equivalent to .B -GKUWRDOB. Note that .B --trails is not implicitly included in this option because it also requires .B --prefix. See the .B --trails option documentation for details. .PP .TP 8 .BI "\-T \-\-trails" Enable the Web Trails feature. The report will show what are the more frequent moves between pages of your site. This option requires the .B --prefix option to work. .PP .TP 8 .BI "\-G \-\-google" Activate two reports about pages accessed by the Google and Adsense web crawlers. Pages are shown ordered accordingly to the last time the Google web crawler requested the page. The first page shown is the latest that was accessed. .PP .TP 8 .BI "\-K \-\-google\-keyphrases" Activate a report that shows common search keyphrases used to found your web site from Google. .PP .TP 8 .BI "\-Z \-\-google\-keyphrases-age" Activate a report that shows common the lastest keyphrases used to found your site from Google. .PP .TP 8 .BI "\-H \-\-google\-human-language" Activate a report that shows common human languages used to serach from Google. This feature uses the 'hl' variable of the Google referer URL. .PP .TP 8 .BI "\-U \-\-user\-agents" Show information about common user agents. .PP .TP 8 .BI "\-W \-\-weekday\-hour\-map" Activate the generation of a combined weekdays/hours bidimensional map that shows information about traffic in every 168 different hours of a 7 days week. Brighter colors mean higher traffic. This is ideal to figure what's the best moment on a week for a maintenance downtime, what's the target of the site, if people are accessing it from work or from home, and so on. The map is generated as pure html inside the report. .PP .TP 8 .BI "\-M \-\-month\-day\-map" Activate the generation of a combined month/day bidimensional map that shows information about traffic in every 365 different days of the year. Brighter colors mean higher traffic. This is useful in order to figure with a quick look traffic trends and days with particuarly high or low traffic. The map is generated as pure html inside the report. .PP .TP 8 .BI "\-R \-\-referers\-age" Shows referers ordered by age. The 'age' of a referer is the date it appeared the first time. In the report, newer referers are on top. This report is useful to check for new external links. .PP .TP 8 .BI "\-D \-\-domains" Activate the generation of information about Top Level Domains popularity. This information may be useful to guess the amount of visits from different countries. Note that Visitors will not resolve numerical IP addresses if they are not already resolved in the log file. All the unresolved IP addresses will be shown in this report under the entry Unresolved IP. .PP .TP 8 .BI "\-O \-\-operating\-systems" Activate the report about Operating Systems popularity, sorted by number of accesses. All the common operating systems are listed in the report, while unknown operating systems will be summed in the unknown entry. .PP .TP 8 .BI "\-B \-\-browsers" Activate the report about Browsers popularity, sorted by number of accesses. All the common browsers are listed in the report, while unknown browsers will be summed in the unknown entry. Browsers are listed by family (for example Internet Explorer, Opera, and so on), and not by specific version. .PP .TP 8 .BI "\-X \-\-error404" Activate the generation of missing documents (404 error) report. This report will show files requested, but missing, ordered by number of requests. The report is useful in order to discover if for some mistake there is some file missing in the web site, but often you will see bizarre requests performed by users or internet worms and security scans. .PP .TP 8 .BI "\-Y \-\-pageviews" Activate the generation of a report that shows (and approximation) of the percentage of pages viewed per unique visit. The goal of this report is to understand the usage pattern of the site and the level of interest of the visitors. For example, in a site that provides a number of pages with interesting contents, the percentage of visitors performing a single page view per visit is probably searching for something else. .PP .TP 8 .BI "\-S \-\-robots" Activate the generation of a report that shows user agents of clients requesting the file robots.txt, with the exception of the MSIE Crawler requests. The result is a list of web robots and spieders that accessed your web site, ordered by number of requests of robots.txt. .PP .TP 8 .BI "\-\-screen\-info" Activate the screen resolution and color depth reports. Note that for this report to work you have to insert on your HTML pages the javascript code you can find in the README file in the visitors tarball. .PP .TP 8 .BI "\-\-stream" Enable the Stream Mode (see the .B STREAM MODE DETAILS section for more information). Shortly: when in stream mode .I Visitors will process all the log files specified (possibly none, that's valid in this mode) as usual, producing the report. Then the stream mode is entered and .I Visitors will start to read from standard input for a continuous stream of web logs, updating the statistics incrementally as new data is available. A new report is produced periodically if new data arrived, accordingly to the .B --update-every option (default is to update the statistics every ten minutes). It's possible to ask .I Visitors to reset the statistics after some period of time using the .B --reset-every option. This allows to have a snapshot of what is going on in the last five minutes, hour, day or week. Note that .B --stream requires .B --output-file because .I Visitors needs to overwrite the report for every update, so can't output to standard output as usually. If you plan to use the stream mode, also check the .B --tail option. .PP .TP 8 .BI "\-\-update\-every" " seconds" By default in Stream Mode statistics are updated every 10 minutes. This option specifies a different period in seconds. .PP .TP 8 .BI "\-\-reset\-every" " seconds" By default in Stream Mode statistics are never reset, but continuously updated incrementally. This option specifies to reset statistics after the given amount of time in seconds. This is useful to have a snapshot of the web site usage. .PP .TP 8 .BI "\-f \-\-output\-file" " file" Write output to .I file instead of stdout. .PP .TP 8 .BI "\-m \-\-max\-lines" " number" Set the max number of entries that should be shown in reports like referers, keyphrases and so on. This option sets all the reports max number of entries for all the reports at once. .PP .TP 8 .BI "\-r \-\-max\-referers" " number" Set the max number of entries in the referer report. .PP .TP 8 .BI "\-p \-\-max\-pages" " number" Set the max number of entries in the accessed pages report. .PP .TP 8 .BI "\-i \-\-max\-images" " number" Set the max number of entries in the accessed images report. .PP .TP 8 .BI "\-x \-\-max\-error404" " number" Set the max number of entries in the missing documents report. .PP .TP 8 .BI "\-u \-\-max\-useragents" " number" Set the max number of entries in the user agents report. .PP .TP 8 .BI "\-t \-\-max\-trails" " number" Set the max number of entries in the web trails report. .PP .TP 8 .BI "\-g \-\-max\-googled" " number" Set the max number of entries in the crawled pages report (google bot). .PP .TP 8 .BI " \-\-max\-adsensed" " number" Set the max number of entries in the crawled pages report (adsense bot). .PP .TP 8 .BI "\-k \-\-max\-google\-keyphrases" " number" Set the max number of entries in the Google keyphrases report. .PP .TP 8 .BI "\-a \-\-max\-referers\-age" " number" Set the max number of entries in the referers by date report. .PP .TP 8 .BI "\-d \-\-max\-domains" " number" Set the max number of entries in the domains report. .PP .TP 8 .BI "\-P \-\-prefix" " number" Prefixes specify to visitors how a link should look like to be classified as internal to your site. This option is required for .B --trails and will also have the nice effect to avoid that internal links are shown in the referers report. If you are analyzing statistics for http://www.your.site.com/, just use: .B --prefix http://www.your.site.com If your site is reachable using more hostnames you should specify all these, like in the following example: .br .B --prefix http://www.your.site.com --prefix http://your.site.com .PP .TP 8 .BI "\-o \-\-output" " html|text" Output module. You can use text or html. The default is html. .PP .TP 8 .BI "\-V \-\-graphviz" This option enables the Graphviz mode: .I Visitors will analyze the log file and create a graph describing the access patterns of your web site. The information used to create the graph is the same as the web trails report (that you can enable with --trails), but as a graph it can be more readable for non trivial sites. An example on how to use this feature: % visitors access.log --prefix http://www.hping.org \\ --graphviz > graph.dot % dot /tmp/graph.dot -Tpng > graph.png On Debian systems, the .B dot command is included in the .B graphviz package. The generated graph will have edges of different colors, from blue to red to specify a low to high level of popularity of a given movement from one page to another of the web site. This option requires one or more .B --prefix options in order to work, just like the .B --trails option. .PP .TP 8 .BI "\-V \-\-graphviz-ignorenode-google" Don't put the google node on the generated graph. Only useful with .B --trails .PP .TP 8 .BI "\-V \-\-graphviz-ignorenode-external" Don't put the external referer node on the generated graph. Only useful with .B --trails .PP .TP 8 .BI "\-V \-\-graphviz-ignorenode-noreferer" Don't put the node indicating requests without referer on the generated graph. Only useful with .B --trails .PP .TP 8 .BI "\-\-tail" When this option is specified .I Visitors will emulate the Unix command tail -f --max-unchanged-stats=1 -q. You can specify the log file names to monitor for changes, once new data is appended in any of the specified file, visitors will output the new data to the standard output. This option is useful conjunction to the Stream Mode (--stream). Files can be log-rotated because .I Visitors in Tail Mode will always try to reopen the file to check for changes. .PP .TP 8 .BI "\-\-time\-delta" " delta" If your web server is in a different timezone than most of your visitors or yourself, you will notice a shift in the reports regarding time and days of week. By default, .I Visitors will generate output using the host's locale. You can use the .B --time-delta option in order to adjust the output. Positive values will shift on the right (toward future) from the given number of hours, negative values will shift on the left (toward past). In the future this option may have support to directly specify the output timezone. .PP .TP 8 .BI "\-\-filter\-spam" Filter referer spam using a keyword-based filter (see blacklist.h for more information on keywords). If you don't know what referer spam is check this Wikipedia page: http://en.wikipedia.org/wiki/Referer_spam .PP .TP 8 .BI "\-\-ignore\-404" When this option is turned on log lines with 404 errors are just used to generate the 404 errors report and not used for other reports. .PP .TP 8 .BI "\-\-grep" " pattern" Process only log lines matching the specified pattern. Patterns are matched using the glob-style matching (the one used by the unix shell): .RS .IP \fB*\fR 10 Matches any sequence of characters in \fIstring\fR, including a null string. .IP \fB?\fR 10 Matches any single character in \fIstring\fR. .IP \fB[\fIchars\fB]\fR 10 Matches any character in the set given by \fIchars\fR. If a sequence of the form \fIx\fB\-\fIy\fR appears in \fIchars\fR, then any character between \fIx\fR and \fIy\fR, inclusive, will match. .IP \fB\e\fIx\fR 10 Matches the single character \fIx\fR. This provides a way of avoiding the special interpretation of the characters \fB*?[]\e\fR in \fIpattern\fR. .RE For default matching is performed in a case sensitive way, but case insensitive matching may be forced prefixing the pattern with the string \fBcs:\fR, so for example the pattern \fBcs:firefox\fR will match all the log lines containing the string firefox, FireFox, FIREFOX and so on. .PP .TP 8 .BI "\-\-exclude" " pattern" Works exactly like \fB--grep\fR, but only lines NOT matching the specified pattern are processed. Note that --grep and --exclude can be used multiple times, and are processed sequentially. For example \fBvisitors --grep firefox --exclude download\fR will process only lines including the string firefox but not including the string download. .PP .TP 8 .BI "\-\-debug" Show additional information on errors. For example invalid lines are printed on the standard error if found. Mainly useful for developers and error reporting. .PP .TP 8 .BI "\-h \-\-help" Show usage and copyright information. .PP .TP 8 .BI "\-v \-\-version" Show program version. .SH EXAMPLES The simplest usage, to be used interactively when you have a web log to check (for example over ssh in your web server), just use: % visitors access.log | less That will produce a human readable output in text only. To generate html web stats with much more information you may use instead this: % visitors --output text -A -m 30 access.log -o html > report.html If you want information on the usage patterns for your site you must provide the url prefix of your web site, and specify the .B --trails option. The next example produces an HTML report with usage patterns information. % visitors -A -m 30 access.log --trails \\ --prefix http://www.hping.org > report.html Note that it's ok to specify multiple file names, or to provide the input using the standard input like in the following two examples: % visitors /var/log/apache/access.log.* .br % zcat access.log.*.gz | visitors - .SH STREAM MODE DETAILS .PP The usual way to run .I Visitors is to specify some option to control the report generation, and the name of log files. For example to generate a report from two Apache's access log files you can write: % visitors -A access.log.1 access.log.2 > report.html .I Visitors will analyze the log files, and will output the report. Sometimes it can be more interesting to have web statistics updated continuously, almost in real time, as new data is available. In order to provide this feature .I Visitors implements a mode called Stream Mode that reads a stream of logs from the standard input. The following command line shows how to use it (but check the --stream option documentation for more information). % tail -f /var/log/apache/access.log | \\ visitors --stream -A --update-every 60 \\ --output-file /tmp/report.html .I Visitors will incrementally update the statistics as new logs are available and will update the html report every 60 seconds. As you can see in this mode is required to specify the report file name using the .B --output-file option because .I Visitors needs to overwrite the report to update it. Note that instead of the tail command in the above example it is possible to use instead .I Visitors in Tail Mode (an emulation for the tail program): % visitors --tail /var/log/apache/access.log | \\ visitors --stream -A --update-every 60 \\ --output-file /tmp/report.html It's possible to generate real time statistics about the last N seconds of web traffic, where N is configurable and can be from few seconds to one week or more, using the .B --reset-every option. The following example generates statistics updated every 30 seconds about the last hour of traffic: % visitors --tail /var/log/apache/access.log | \\ visitors --stream -A --update-every 30 --reset-every 3600 \\ --output-file /tmp/report.html .SH "AUTHORS" .PP .I Visitors was written by Salvatore Sanfilippo . .SH "COPYING" Copyright .if t \(co .if n (C) 2004,2005 Salvatore Sanfilippo . .PP .I Visitors is distributed under the GNU General Public License. .PP This manual page was written (based on the original HTML documentation) by Romain Francoise for the Debian GNU/Linux system, but may be used by others. Salvatore Sanfilippo updated this man page starting from Visitors 0.5, this manual page is now part of the Visitors tarball. visitors_0.7/visitors.c0100644000175000017500000031530510412774745015307 0ustar antirezantirez/* visitors -- very fast web logs analyzer. * * Copyright (C) 2004-2006 Salvatore Sanfilippo * All Rights Reserved. * * This software is released under the terms of the GPL license version 2. * Read the COPYING file in this distribution for more details. */ #include #include #include #include #include #include #include #include #include "aht.h" #include "antigetopt.h" #include "sleep.h" #include "blacklist.h" /* Max length of an error stored in the visitors handle */ #define VI_ERROR_MAX 1024 /* Max length of a log line */ #define VI_LINE_MAX 4096 /* Max number of filenames in the command line */ #define VI_FILENAMES_MAX 1024 /* Max number of prefixes in the command line */ #define VI_PREFIXES_MAX 1024 /* Max number of --grep --exclude patterns in the command line */ #define VI_GREP_PATTERNS_MAX 1024 /* Abbreviation length for HTML outputs */ #define VI_HTML_ABBR_LEN 100 /* Version as a string */ #define VI_DATE_MAX 64 /* Max length of a log entry date */ #define VI_VERSION_STR "0.7" /*------------------------------- data structures ----------------------------*/ /* visitors handle */ struct vih { int startt; int endt; int processed; int invalid; int blacklisted; int hour[24]; int weekday[7]; int weekdayhour[7][24]; /* hour and weekday combined data */ int monthday[12][31]; /* month and day combined data */ struct hashtable visitors; struct hashtable googlevisitors; struct hashtable pages; struct hashtable images; struct hashtable error404; struct hashtable pageviews; struct hashtable pageviews_grouped; struct hashtable referers; struct hashtable referersage; struct hashtable date; struct hashtable googledate; struct hashtable adsensed; struct hashtable month; struct hashtable googlemonth; struct hashtable agents; struct hashtable googled; struct hashtable googlevisits; struct hashtable googlekeyphrases; struct hashtable googlekeyphrasesage; struct hashtable trails; struct hashtable tld; struct hashtable os; struct hashtable browsers; struct hashtable robots; struct hashtable googlehumanlanguage; struct hashtable screenres; struct hashtable screendepth; char *error; }; /* info associated with a line of log */ struct logline { char *host; char *date; char *hour; char *timezone; char *req; char *ref; char *agent; time_t time; struct tm tm; }; /* output module structure. See below for the definition of * the text and html output modules. */ struct outputmodule { void (*print_header)(FILE *fp); void (*print_footer)(FILE *fp); void (*print_title)(FILE *fp, char *title); void (*print_subtitle)(FILE *fp, char *title); void (*print_numkey_info)(FILE *fp, char *key, int val); void (*print_keykey_entry)(FILE *fp, char *key1, char *key2, int num); void (*print_numkey_entry)(FILE *fp, char *key, int val, char *link, int num); void (*print_numkeybar_entry)(FILE *fp, char *key, int max, int tot, int this); void (*print_numkeycomparativebar_entry)(FILE *fp, char *key, int tot, int this); void (*print_bidimentional_map)(FILE *fp, int xlen, int ylen, char **xlabel, char **ylabel, int *value); void (*print_hline)(FILE *fp); void (*print_credits)(FILE *fp); void (*print_report_link)(FILE *fp, char *report); }; /* Just a string with cached length */ struct vistring { char *str; int len; }; /* Grep pattern for --grep --exclude */ #define VI_PATTERNTYPE_GREP 0 #define VI_PATTERNTYPE_EXCLUDE 1 struct greppat { int type; char *pattern; }; /* ---------------------- global configuration parameters ------------------- */ int Config_debug = 0; int Config_max_referers = 20; int Config_max_referers_age = 20; int Config_max_pages = 20; int Config_max_images = 20; int Config_max_error404 = 20; int Config_max_agents = 20; int Config_max_googled = 20; int Config_max_adsensed = 20; int Config_max_google_keyphrases = 20; int Config_max_google_keyphrases_age = 20; int Config_max_trails = 20; int Config_max_tld = 20; int Config_max_robots = 20; int Config_process_agents = 0; int Config_process_google = 0; int Config_process_google_keyphrases = 0; int Config_process_google_keyphrases_age = 0; int Config_process_google_human_language = 0; int Config_process_web_trails = 0; int Config_process_weekdayhour_map = 0; int Config_process_monthday_map = 0; int Config_process_referers_age = 0; int Config_process_tld = 0; int Config_process_os = 0; int Config_process_browsers = 0; int Config_process_error404 = 0; int Config_process_pageviews = 0; int Config_process_monthly_visitors = 1; int Config_process_robots = 0; int Config_process_screen_info = 0; int Config_graphviz_mode = 0; int Config_graphviz_ignorenode_google = 0; int Config_graphviz_ignorenode_external = 0; int Config_graphviz_ignorenode_noreferer = 0; int Config_tail_mode = 0; int Config_stream_mode = 0; int Config_update_every = 60*10; /* update every 10 minutes for default. */ int Config_reset_every = 0; /* never reset for default */ int Config_time_delta = 0; /* adjustable time difference */ int Config_filter_spam = 0; int Config_ignore_404 = 0; char *Config_output_file = NULL; /* stdout if not set. */ struct outputmodule *Output = NULL; /* intialized to 'text' in main() */ /* Prefixes */ int Config_prefix_num = 0; /* number of set prefixes */ struct vistring Config_prefix[VI_PREFIXES_MAX]; /* Grep/Exclude array */ struct greppat Config_grep_pattern[VI_GREP_PATTERNS_MAX]; int Config_grep_pattern_num = 0; /* number of set patterns */ /*----------------------------------- Tables ---------------------------------*/ static char *vi_wdname[7] = {"Mo", "Tu", "We", "Th", "Fr", "Sa", "Su"}; #if 0 static int vi_monthdays[12] = {31, 29, 31, 30, 31, 30 , 31, 31, 30, 31, 30, 31}; #endif /* -------------------------------- prototypes ------------------------------ */ void vi_clear_error(struct vih *vih); void vi_tail(int filec, char **filev); /*------------------- Options parsing help functions ------------------------ */ void ConfigAddGrepPattern(char *pattern, int type) { char *s; int len = strlen(pattern); if (Config_grep_pattern_num == VI_GREP_PATTERNS_MAX) { fprintf(stderr, "Too many grep/exclude options specified\n"); exit(1); } s = malloc(strlen(pattern)+3); s[0] = '*'; memcpy(s+1, pattern, len); s[len+1] = '*'; s[len+2] = '\0'; Config_grep_pattern[Config_grep_pattern_num].type = type; Config_grep_pattern[Config_grep_pattern_num].pattern = s; Config_grep_pattern_num++; } /*------------------------------ support functions -------------------------- */ /* Returns non-zero if the link seems like a google link, zero otherwise. * Note that this function only checks for a prefix of www.google.. * so may be fooled. */ int vi_is_google_link(char *s) { return !strncmp(s, "http://www.google.", 18); } /* Returns non-zero if the user agent appears to be the GoogleBot. */ int vi_is_googlebot_agent(char *agent) { if (strstr(agent, "Googlebot") || strstr(agent, "googlebot")) return 1; return 0; } /* Returns non-zero if the user agent appears to be the Mediapartners-Google. */ int vi_is_adsensebot_agent(char *agent) { if (strstr(agent, "Mediapartners-Google")) return 1; return 0; } int vi_is_yahoobot_agent(char *agent) { if (strstr(agent, "Yahoo! Slurp")) return 1; return 0; } int vi_is_msbot_agent(char *agent) { if (strstr(agent, "msn.com/msnbot.htm")) return 1; return 0; } /* Try to guess if a given agent string is about a crawler/bot * of some time. This function MUST be conservative, because * false negatives are acceptable while false positives arent. */ int vi_is_genericbot_agent(char *agent) { if (strstr(agent, "crawler") || strstr(agent, "Crawler") || strstr(agent, "bot/") || strstr(agent, "Bot/") || strstr(agent, "bot.htm") || strstr(agent, "+http://")) return 1; return 0; } int vi_is_bot_agent(char *agent) { if (vi_is_googlebot_agent(agent) || vi_is_adsensebot_agent(agent) || vi_is_yahoobot_agent(agent) || vi_is_msbot_agent(agent)) return 1; return 0; } /* Returns non-zero if the url matches some user-specified prefix. * being a link "internal" to the site. Otherwise zero is returned. * * When there is a match, the value returned is the length of * the matching prefix. */ int vi_is_internal_link(char *url) { int i, l; if (!Config_prefix_num) return 0; /* no prefixes set? */ l = strlen(url); for (i = 0; i < Config_prefix_num; i++) { if (Config_prefix[i].len <= l && !strncasecmp(url, Config_prefix[i].str, Config_prefix[i].len)) { return Config_prefix[i].len; } } return 0; } /* returns non-zero if the URL 's' seems an image or a CSS file. */ int vi_is_image(char *s) { int l = strlen(s); char *end = s + l; /* point to the nul term */ if (l < 5) return 0; if (!memcmp(end-4, ".css", 4) || !memcmp(end-4, ".jpg", 4) || !memcmp(end-4, ".gif", 4) || !memcmp(end-4, ".png", 4) || !memcmp(end-4, ".ico", 4) || !memcmp(end-4, ".swf", 4) || !memcmp(end-3, ".js", 3) || !memcmp(end-5, ".jpeg", 5) || !memcmp(end-4, ".CSS", 4) || !memcmp(end-4, ".JPG", 4) || !memcmp(end-4, ".GIF", 4) || !memcmp(end-4, ".PNG", 4) || !memcmp(end-4, ".ICO", 4) || !memcmp(end-4, ".SWF", 4) || !memcmp(end-3, ".JS", 3) || !memcmp(end-5, ".JPEG", 5)) return 1; return 0; } /* returns non-zero if the URL 's' seems a real page. */ int vi_is_pageview(char *s) { int l = strlen(s); char *end = s + l; /* point to the nul term */ char *dot, *slash; if (s[l-1] == '/') return 1; if (l >= 6 && (!memcmp(end-5, ".html", 5) || !memcmp(end-4, ".htm", 4) || !memcmp(end-4, ".php", 4) || !memcmp(end-4, ".asp", 4) || !memcmp(end-4, ".jsp", 4) || !memcmp(end-4, ".xdl", 4) || !memcmp(end-5, ".xhtml", 5) || !memcmp(end-4, ".xml", 4) || !memcmp(end-4, ".cgi", 4) || !memcmp(end-3, ".pl", 3) || !memcmp(end-6, ".shtml", 6) || !memcmp(end-5, ".HTML", 5) || !memcmp(end-4, ".HTM", 4) || !memcmp(end-4, ".PHP", 4) || !memcmp(end-4, ".ASP", 4) || !memcmp(end-4, ".JSP", 4) || !memcmp(end-4, ".XDL", 4) || !memcmp(end-6, ".XHTML", 6) || !memcmp(end-4, ".XML", 4) || !memcmp(end-4, ".CGI", 4) || !memcmp(end-3, ".PL", 3) || !memcmp(end-6, ".SHTML", 6))) return 1; dot = strrchr(s, '.'); if (!dot) return 1; slash = strrchr(s, '/'); if (slash && slash > dot) return 1; return 0; } /* returns non-zero if 'ip' seems a string representing an IP address * like "1.2.3.4". Note that 'ip' is always an IP or an hostname * so this function actually test if the string pointed by 'ip' only * contains characters in the "[0-9.]" set */ int vi_is_numeric_address(char *ip) { unsigned int l = strlen(ip); return strspn(ip, "0123456789.") == l; } /* returns the time converted into a time_t value. * On error (time_t) -1 is returned. * Note that this function is specific for the following format: * "10/May/2004:04:15:33". Works if the month is not an abbreviation, or if the * year is abbreviated to only the last two digits. * The time can be omitted like in "10/May/2004". */ time_t parse_date(char *s, struct tm *tmptr) { struct tm tm; time_t t; char *months[] = { "jan", "feb", "mar", "apr", "may", "jun", "jul", "aug", "sep", "oct", "nov", "dec", }; char *day, *month, *year, *time = NULL; char monthaux[32]; int i, len; /* make a copy to mess with it */ len = strlen(s); if (len >= 32) goto fmterr; memcpy(monthaux, s, len); monthaux[len] = '\0'; /* Inizialize the tm structure. We just fill three fields */ tm.tm_sec = 0; tm.tm_min = 0; tm.tm_hour = 0; tm.tm_mday = 0; tm.tm_mon = 0; tm.tm_year = 0; tm.tm_wday = 0; tm.tm_yday = 0; tm.tm_isdst = -1; /* search delimiters */ day = monthaux; if ((month = strchr(day, '/')) == NULL) goto fmterr; *month++ = '\0'; if ((year = strchr(month, '/')) == NULL) goto fmterr; *year++ = '\0'; /* time, optional for this parser. */ if ((time = strchr(year, ':')) != NULL) { *time++ = '\0'; } /* convert day */ tm.tm_mday = atoi(day); if (tm.tm_mday < 1 || tm.tm_mday > 31) goto fmterr; /* convert month */ if (strlen(month) < 3) goto fmterr; month[0] = tolower(month[0]); month[1] = tolower(month[1]); month[2] = tolower(month[2]); for (i = 0; i < 12; i++) { if (memcmp(month, months[i], 3) == 0) break; } if (i == 12) goto fmterr; tm.tm_mon = i; /* convert year */ tm.tm_year = atoi(year); if (tm.tm_year > 100) { if (tm.tm_year < 1900 || tm.tm_year > 2500) goto fmterr; tm.tm_year -= 1900; } else { /* if the year is in two-digits form, the 0 - 68 range * is converted to 2000 - 2068 */ if (tm.tm_year < 69) tm.tm_year += 100; } /* convert time */ if (time) { /* format is HH:MM:SS */ if (strlen(time) < 8) goto fmterr; tm.tm_hour = ((time[0]-'0')*10)+(time[1]-'0'); if (tm.tm_hour < 0 || tm.tm_hour > 23) goto fmterr; tm.tm_min = ((time[3]-'0')*10)+(time[4]-'0'); if (tm.tm_min < 0 || tm.tm_min > 59) goto fmterr; tm.tm_sec = ((time[6]-'0')*10)+(time[7]-'0'); if (tm.tm_sec < 0 || tm.tm_sec > 60) goto fmterr; } t = mktime(&tm); if (t == (time_t)-1) goto fmterr; t += (Config_time_delta*3600); if (tmptr) { struct tm *auxtm; if ((auxtm = localtime(&t)) != NULL) *tmptr = *auxtm; } return t; fmterr: /* format error */ return (time_t) -1; } /* returns 1 if the given date is Saturday or Sunday. * Zero is otherwise returned. */ int vi_is_weekend(char *s) { struct tm tm; if (parse_date(s, &tm) != (time_t)-1) { if (tm.tm_wday == 0 || tm.tm_wday == 6) return 1; } return 0; } #if 0 /* Returns true if 'year' is a leap year. */ int isleap(int year) { int conda, condb, condc; conda = (year%4) == 0; condb = (year%100) == 0; condc = (year%400) == 0; return conda && !(condb && !condc); } #endif /* URL decoding and white spaces trimming function. * Input: the encoded string 's'. * Output: the decoded string written at 'd' that has room for at least 'n' * bytes of data. */ void vi_urldecode(char *d, char *s, int n) { char *start = d; if (n < 1) return; while(*s && n > 1) { int c = *s; switch(c) { case '+': c = ' '; break; case '%': if (*(s+1) && *(s+2)) { int high = toupper(*(s+1)); int low = toupper(*(s+2)); if (high <= '9') high -= '0'; else high = (high - 'A') + 10; if (low <= '9') low -= '0'; else low = (low - 'A') + 10; c = (high << 4)+low; s += 2; } break; } if (c != ' ' || d != start) { *d++ = c; n--; } s++; } /* Right trim */ *d = '\0'; d--; while (d >= start && *d == ' ') { *d = '\0'; d--; } } /* URL encoding function * Input: the unencoded string 's'. * Output: the url-encoded string written at 'd' that has room for at least 'n' * bytes of data. */ void vi_urlencode(char *d, char *s, int n) { if (n < 1) return; n--; while(*s && n > 0) { int c = *s; if ((c >= 'A' && c <= 'Z') || (c >= 'a' && c <= 'z') || (c >= '0' && c <= '9')) { *d++ = c; n--; } else if (c == ' ') { *d++ = '+'; n--; } else if (c == '\n') { if (n < 6) break; memcpy(d, "%0d%0a", 6); d += 6; n -= 6; } else { unsigned int t; char *hexset = "0123456789abcdef"; if (n < 3) break; t = (unsigned) c; *d++ = '%'; *d++ = hexset [(t & 0xF0) >> 4]; *d++ = hexset [(t & 0x0F)]; n -= 3; } s++; } *d = '\0'; } /* Convert a nul-term string to lowercase in place */ void vi_strtolower(char *s) { while (*s) { *s = tolower(*s); s++; } } /* Note: the following function strlcat and strlcpy are (possibly) modified * version of OpenBSD's functions. Original copyright notice: * Copyright (c) 1998 Todd C. Miller * Originally under the BSD license. */ int vi_strlcpy(char *dst, char *src, int siz) { char *d = dst; const char *s = src; int n = siz; /* Copy as many bytes as will fit */ if (n != 0 && --n != 0) { do { if ((*d++ = *s++) == 0) break; } while (--n != 0); } /* Not enough room in dst, add NUL and traverse rest of src */ if (n == 0) { if (siz != 0) *d = '\0'; /* NUL-terminate dst */ while (*s++) ; } return(s - src - 1); /* count does not include NUL */ } int vi_strlcat(char *dst, const char *src, int siz) { char *d = dst; const char *s = src; size_t n = siz; size_t dlen; /* Find the end of dst and adjust bytes left but don't go past end */ while (n-- != 0 && *d != '\0') d++; dlen = d - dst; n = siz - dlen; if (n == 0) return(dlen + strlen(s)); while (*s != '\0') { if (n != 1) { *d++ = *s; n--; } s++; } *d = '\0'; return(dlen + (s - src)); /* count does not include NUL */ } /* Returns non-zero if the url matches one of the keywords in * blacklist.h, otherwise zero is returned. Warning!!! This function * run time is proportional to the size of blacklist.h, so it is * very slow. */ int vi_is_blacklisted_url(struct vih *vih, char *url) { unsigned int i; for (i = 0; i < VI_BLACKLIST_LEN; i++) { if (strstr(url, vi_blacklist[i])) { vih->blacklisted++; return 1; } } return 0; } /* Glob-style pattern matching. */ int vi_match_len(const char *pattern, int patternLen, const char *string, int stringLen, int nocase) { while(patternLen) { switch(pattern[0]) { case '*': while (pattern[1] == '*') { pattern++; patternLen--; } if (patternLen == 1) return 1; /* match */ while(stringLen) { if (vi_match_len(pattern+1, patternLen-1, string, stringLen, nocase)) return 1; /* match */ string++; stringLen--; } return 0; /* no match */ break; case '?': if (stringLen == 0) return 0; /* no match */ string++; stringLen--; break; case '[': { int not, match; pattern++; patternLen--; not = pattern[0] == '^'; if (not) { pattern++; patternLen--; } match = 0; while(1) { if (pattern[0] == '\\') { pattern++; patternLen--; if (pattern[0] == string[0]) match = 1; } else if (pattern[0] == ']') { break; } else if (patternLen == 0) { pattern--; patternLen++; break; } else if (pattern[1] == '-' && patternLen >= 3) { int start = pattern[0]; int end = pattern[2]; int c = string[0]; if (start > end) { int t = start; start = end; end = t; } if (nocase) { start = tolower(start); end = tolower(end); c = tolower(c); } pattern += 2; patternLen -= 2; if (c >= start && c <= end) match = 1; } else { if (!nocase) { if (pattern[0] == string[0]) match = 1; } else { if (tolower((int)pattern[0]) == tolower((int)string[0])) match = 1; } } pattern++; patternLen--; } if (not) match = !match; if (!match) return 0; /* no match */ string++; stringLen--; break; } case '\\': if (patternLen >= 2) { pattern++; patternLen--; } /* fall through */ default: if (!nocase) { if (pattern[0] != string[0]) return 0; /* no match */ } else { if (tolower((int)pattern[0]) != tolower((int)string[0])) return 0; /* no match */ } string++; stringLen--; break; } pattern++; patternLen--; if (stringLen == 0) { while(*pattern == '*') { pattern++; patternLen--; } break; } } if (patternLen == 0 && stringLen == 0) return 1; return 0; } /* Like vi_match_len but more handly if used against nul-term strings. */ int vi_match(const char *pattern, const char *string, int nocase) { int patternLen = strlen(pattern); int stringLen = strlen(string); return vi_match_len(pattern, patternLen, string, stringLen, nocase); } /*-------------------------- visitors handler functions --------------------- */ /* Init the hashtable with methods suitable for an "occurrences counter" */ void vi_ht_init(struct hashtable *ht) { ht_init(ht); ht_set_hash(ht, ht_hash_string); ht_set_key_destructor(ht, ht_destructor_free); ht_set_val_destructor(ht, ht_no_destructor); ht_set_key_compare(ht, ht_compare_string); } /* Reset the weekday/hour info in the visitors handler. */ void vi_reset_combined_maps(struct vih *vih) { int i, j; for (i = 0; i < 24; i++) { vih->hour[i] = 0; for (j = 0; j < 7; j++) vih->weekdayhour[j][i] = 0; } for (i = 0; i < 7; i++) vih->weekday[i] = 0; for (i = 0; i < 31; i++) for (j = 0; j < 12; j++) vih->monthday[j][i] = 0; } /* Reset the hashtables from the handler, that are left * in a reusable state (but all empty). */ void vi_reset_hashtables(struct vih *vih) { ht_destroy(&vih->visitors); ht_destroy(&vih->googlevisitors); ht_destroy(&vih->pages); ht_destroy(&vih->images); ht_destroy(&vih->error404); ht_destroy(&vih->pageviews); ht_destroy(&vih->pageviews_grouped); ht_destroy(&vih->referers); ht_destroy(&vih->referersage); ht_destroy(&vih->agents); ht_destroy(&vih->googled); ht_destroy(&vih->adsensed); ht_destroy(&vih->googlekeyphrases); ht_destroy(&vih->googlekeyphrasesage); ht_destroy(&vih->googlevisits); ht_destroy(&vih->trails); ht_destroy(&vih->tld); ht_destroy(&vih->os); ht_destroy(&vih->browsers); ht_destroy(&vih->date); ht_destroy(&vih->googledate); ht_destroy(&vih->month); ht_destroy(&vih->googlemonth); ht_destroy(&vih->robots); ht_destroy(&vih->googlehumanlanguage); ht_destroy(&vih->screenres); ht_destroy(&vih->screendepth); } /* Reset handler informations to support --reset option in * stream mode. */ void vi_reset(struct vih *vih) { vi_reset_combined_maps(vih); vi_reset_hashtables(vih); } /* Return a new visitors handle. * On out of memory NULL is returned. * The handle obtained with this call must be released with vi_free() * when no longer useful. */ struct vih *vi_new(void) { struct vih *vih; if ((vih = malloc(sizeof(*vih))) == NULL) return NULL; /* Initialization */ vih->startt = vih->endt = time(NULL); vih->processed = 0; vih->invalid = 0; vih->blacklisted = 0; vi_reset_combined_maps(vih); vih->error = NULL; vi_ht_init(&vih->visitors); vi_ht_init(&vih->googlevisitors); vi_ht_init(&vih->pages); vi_ht_init(&vih->images); vi_ht_init(&vih->error404); vi_ht_init(&vih->pageviews); vi_ht_init(&vih->pageviews_grouped); vi_ht_init(&vih->referers); vi_ht_init(&vih->referersage); vi_ht_init(&vih->agents); vi_ht_init(&vih->googled); vi_ht_init(&vih->adsensed); vi_ht_init(&vih->googlevisits); vi_ht_init(&vih->googlekeyphrases); vi_ht_init(&vih->googlekeyphrasesage); vi_ht_init(&vih->trails); vi_ht_init(&vih->tld); vi_ht_init(&vih->os); vi_ht_init(&vih->browsers); vi_ht_init(&vih->date); vi_ht_init(&vih->month); vi_ht_init(&vih->googledate); vi_ht_init(&vih->googlemonth); vi_ht_init(&vih->robots); vi_ht_init(&vih->googlehumanlanguage); vi_ht_init(&vih->screenres); vi_ht_init(&vih->screendepth); return vih; } /* Free an handle created with vi_new(). */ void vi_free(struct vih *vih) { if (!vih) return; vi_reset_hashtables(vih); vi_clear_error(vih); free(vih); } /* Add a new entry in the counter hashtable. If the key does not * exists creates a new entry with "1" as number of hits, otherwise * increment the old value. * * Return the value of hits after the increment or creation. If the * returned value is greater than one, the key was already seen. * * Return 0 on out of memory. * * NOTE: the pointer of the "value" part of the hashtable entry is * used as a counter casting it to a "long" integer. */ int vi_counter_incr(struct hashtable *ht, char *key) { char *k; unsigned int idx; int r; long val; r = ht_search(ht, key, &idx); if (r == HT_NOTFOUND) { k = strdup(key); if (k == NULL) return 0; if (ht_add(ht, k, (void*)1) != HT_OK) { free(k); return 0; } return 1; } else { val = (long) ht_value(ht, idx); val++; ht_value(ht, idx) = (void*) val; return val; } } /* Similar to vi_counter_incr, but only read the old value of * the counter without to alter it. If the specified key does not * exists zero is returned. */ int vi_counter_val(struct hashtable *ht, char *key) { unsigned int idx; int r; long val; r = ht_search(ht, key, &idx); if (r == HT_NOTFOUND) { return 0; } else { val = (long) ht_value(ht, idx); return val; } } /* Set a key/value pair inside the hash table with * a create-else-replace semantic. * * Return non-zero on out of memory. */ int vi_replace(struct hashtable *ht, char *key, char *value) { char *k, *v; k = strdup(key); v = strdup(value); if (!k || !v) goto err; if (ht_replace(ht, k, v) != HT_OK) goto err; return 0; err: if (k) free(k); if (v) free(v); return 1; } /* Replace the time value of the given key with the new one if this * is newer/older of the old one. If the key is new, it's just added * to the hash table with the specified time as value. * * If the 'ifolder' flag is set, values are replaced with older one, * otherwise with newer. * This function is only used by wrappers replace_if_older() and * replace_if_newer(). * * Return 0 on success, non-zero on out of memory. */ int vi_replace_time(struct hashtable *ht, char *key, time_t time, int ifolder) { char *k = NULL; unsigned int idx; int r; r = ht_search(ht, key, &idx); if (r == HT_NOTFOUND) { k = strdup(key); if (!k) goto err; if (ht_add(ht, k, (void*)time) != HT_OK) goto err; } else { time_t oldt = (time_t) ht_value(ht, idx); /* Update the date if this one is older/nwer. */ if (ifolder) { if (time < oldt) ht_value(ht, idx) = (void*) time; } else { if (time > oldt) ht_value(ht, idx) = (void*) time; } } return 0; err: if (k) free(k); return 1; } /* see vi_replace_time */ int vi_replace_if_older(struct hashtable *ht, char *key, time_t time) { return vi_replace_time(ht, key, time, 1); } /* see vi_replace_time */ int vi_replace_if_newer(struct hashtable *ht, char *key, time_t time) { return vi_replace_time(ht, key, time, 0); } /* Set an error in the visitors handle */ void vi_set_error(struct vih *vih, char *fmt, ...) { va_list ap; char buf[VI_ERROR_MAX]; va_start(ap, fmt); vsnprintf(buf, VI_ERROR_MAX, fmt, ap); buf[VI_ERROR_MAX-1] = '\0'; free(vih->error); vih->error = strdup(buf); va_end(ap); } /* Get the error */ char *vi_get_error(struct vih *vih) { if (!vih->error) { return "No error"; } return vih->error; } /* Clear the error */ void vi_clear_error(struct vih *vih) { free(vih->error); vih->error = NULL; } /*----------------------------------- parsing ----------------------------- */ /* Parse a line of log, and fill the logline structure with * appropriate values. On error (bad line format) non-zero is returned. */ int vi_parse_line(struct logline *ll, char *l) { char *date, *hour, *timezone, *host, *agent, *req, *ref, *p; char *agent_start = NULL, *req_end = NULL, *ref_end = NULL; int agent_without_parens = 0; /* Seek the start of the different components */ /* host */ host = l; /* date */ if ((date = strchr(l, '[')) == NULL) return 1; date++; /* Identify user-agent start char. */ if ((agent = strchr(l, '(')) == NULL) { /* Bad... user agent without (...) string, makes * the detection a bit slower and guessworkish. */ /* Check if the count of '"' chars in the string * is equal to six. If so, it's very likely that the * last field inside "" is the User Agent string, so * we get it. */ char *aux = l, *last = NULL; int count = 0; /* Count '"' chars, save the last occurence found. */ while (*aux) { if (*aux == '"') { count++; last = aux; } aux++; } if (count == 6) { /* Ok! it seems like Combined log format. * Set a flag and get it later when the * rest of the log file is splitted. Now it's * too early to add \0 chars inside the line. */ agent_without_parens = 1; agent_start = last-1; while(*agent_start != '"') agent_start--; } else { /* No way... no user agent detected in this line. */ agent = ""; } } else { /* User agent with () inside. Simple to detect, just * search the left and the right '"' chars enclosing * it. */ p = agent; while (p >= l) { if (*p == '"') { agent_start = p; break; } p--; } } /* req */ if ((req = strstr(l, "\"GET")) != NULL || (req = strstr(l, "\"POST")) != NULL || (req = strstr(l, "\"HEAD")) != NULL || (req = strstr(l, "\"get")) != NULL || (req = strstr(l, "\"post")) != NULL || (req = strstr(l, "\"head")) != NULL) { req++; } else { req = ""; } /* ref */ if ((ref = strstr(l, "\"http")) != NULL || (ref = strstr(l, "\"HTTP")) != NULL) { ref++; } else { ref = ""; } /* Nul-term the components */ /* host */ if ((p = strchr(host, ' ')) == NULL) return 1; *p = '\0'; /* date */ if ((p = strchr(date, ']')) == NULL) return 1; *p = '\0'; ll->time = parse_date(date, &ll->tm); if (ll->time == (time_t)-1) return 1; /* hour */ if ((p = strchr(date, ':')) == NULL) return 1; hour = p+1; *p = '\0'; /* timezone */ if ((p = strchr(hour, ' ')) == NULL) return 1; timezone = p+1; *p = '\0'; /* req */ if ((p = strchr(req, '"')) == NULL) { req = ""; } else { req_end = p; *p = '\0'; if ((p = strchr(req, ' ')) != NULL) { req = p+1; if ((p = strchr(req, ' ')) != NULL) *p = '\0'; } } /* ref */ if ((p = strchr(ref, '"')) == NULL) { ref = ""; } else { ref_end = p; *p = '\0'; } /* agent */ if (agent_without_parens) { /* User agent without (...) inside in a string with six '"' chars. * Just search for the end. */ char *aux = strchr(agent_start+1, '"'); if (!aux) { /* No way! */ agent = ""; } else { *aux = '\0'; agent = agent_start+1; } } else if ((p = strchr(agent, ')')) == NULL) { agent = ""; } else { char *aux; aux = strchr(p, '"'); if (aux) *aux = '\0'; else *(p+1) = '\0'; if (agent_start) { if ((!req_end || (req_end != agent_start)) && (!ref_end || (ref_end != agent_start))) { agent = agent_start+1; } } } /* Fill the struture */ ll->host = host; ll->date = date; ll->hour = hour; ll->timezone = timezone; ll->agent = agent; ll->req = req; ll->ref = ref; return 0; } /* process the weekday and hour information */ void vi_process_date_and_hour(struct vih *vih, int weekday, int hour) { /* Note, the following sanity check is useless in theory. */ if (weekday < 0 || weekday > 6 || hour < 0 || hour > 23) return; vih->weekday[weekday]++; vih->hour[hour]++; /* store the combined info. We always compute this information * even if the report is disabled because it's cheap. */ vih->weekdayhour[weekday][hour]++; } /* process the month and day information */ void vi_process_month_and_day(struct vih *vih, int month, int day) { if (month < 0 || month > 11 || day < 0 || day > 30) return; vih->monthday[month][day]++; } /* Process unique visitors populating the relative hash table. * Return non-zero on out of memory. This is also used to populate * the hashtable used for the "pageviews per user" statistics. * * Note that the last argument 'seen', is an integer passed by reference * that is set to '1' if this is not a new visit (otherwise it's set to zero) */ int vi_process_visitors_per_day(struct vih *vih, char *host, char *agent, char *date, char *ref, char *req, int *seen) { char visday[VI_LINE_MAX], *p, *month = "fixme if I'm here!"; char buf[64]; int res, host_len, agent_len, date_len, hash_len; unsigned long h; /* Ignore visits from Bots */ if (vi_is_bot_agent(agent)) { if (seen != NULL) seen = 0; return 0; } /* Build an unique identifier for this visit * adding together host, date and hash(user agent) */ host_len = strlen(host); agent_len = strlen(agent); date_len = strlen(date); h = djb_hash((unsigned char*) agent, agent_len); sprintf(buf, "%lu", h); hash_len = strlen(buf); if (host_len+agent_len+date_len+4 > VI_LINE_MAX) return 0; p = visday; memcpy(p, host, host_len); p += host_len; *p++ = '|'; memcpy(p, date, date_len); p += date_len; *p++ = '|'; memcpy(p, buf, hash_len); p += hash_len; *p = '\0'; /* fprintf(stderr, "%s\n", visday); */ if (Config_process_monthly_visitors) { /* Skip the day number. */ month = strchr(date, '/'); if (!month) return 0; /* should never happen */ month++; } /* Visits with Google as referer are also stored in another hash * table. */ if (vi_is_google_link(ref)) { res = vi_counter_incr(&vih->googlevisitors, visday); if (res == 0) return 1; /* out of memory */ if (res == 1) { /* new visit! */ res = vi_counter_incr(&vih->googledate, date); if (res == 0) return 1; /* out of memory */ if (Config_process_monthly_visitors) { res = vi_counter_incr(&vih->googlemonth, month); if (res == 0) return 1; /* out of memory */ } } } /* Populate the 'pageviews per visitor' hash table */ if (Config_process_pageviews && vi_is_pageview(req)) { res = vi_counter_incr(&vih->pageviews, visday); if (res == 0) return 1; /* out of memory */ } /* Mark the visit in the non-google-specific hashtable */ res = vi_counter_incr(&vih->visitors, visday); if (res == 0) return 1; /* out of memory */ if (res > 1) { if (seen) *seen = 1; return 0; /* visit alredy seen. */ } if (seen) *seen = 0; /* new visitor */ res = vi_counter_incr(&vih->date, date); if (res == 0) return 1; if (Config_process_monthly_visitors) { res = vi_counter_incr(&vih->month, month); if (res == 0) return 1; } return 0; } /* Process referers populating the relative hash tables. * Return non-zero on out of memory. */ int vi_process_referer(struct vih *vih, char *ref, time_t age) { int res; /* Check the url against the blacklist if needed * this can be very slow... */ if (Config_filter_spam && vi_is_blacklisted_url(vih, ref)) return 0; /* Don't count internal referer (specified by the user * using --prefix options), nor google referers. */ if (vi_is_internal_link(ref)) return !vi_counter_incr(&vih->referers, "Internal Link"); if (vi_is_google_link(ref)) return !vi_counter_incr(&vih->referers, "Google Search Engine"); res = vi_counter_incr(&vih->referers, ref); if (res == 0) return 1; /* Process the referers age if enabled */ if (Config_process_referers_age) { if (vi_replace_if_older(&vih->referersage, ref, age)) return 1; } return 0; } /* Process requested URLs. Split the entries in two hash tables, * one for pages and one for images. * Return non-zero on out of memory. */ int vi_process_page_request(struct vih *vih, char *url) { int res; char urldecoded[VI_LINE_MAX]; vi_urldecode(urldecoded, url, VI_LINE_MAX); if (vi_is_image(url)) res = vi_counter_incr(&vih->images, urldecoded); else res = vi_counter_incr(&vih->pages, urldecoded); if (res == 0) return 1; return 0; } /* Process log lines for 404 errors report. */ int vi_process_error404(struct vih *vih, char *l, char *url, int *is404) { char urldecoded[VI_LINE_MAX]; if (is404) *is404 = 0; vi_urldecode(urldecoded, url, VI_LINE_MAX); if (strstr(l, " 404 ") && !strstr(l, " 200 ")) { if (is404) *is404 = 1; return !vi_counter_incr(&vih->error404, urldecoded); } return 0; } /* Process agents populating the relative hash table. * Return non-zero on out of memory. */ int vi_process_agents(struct vih *vih, char *agent) { int res; res = vi_counter_incr(&vih->agents, agent); if (res == 0) return 1; return 0; } /* Match the list of keywords 't' against the string 's', and if * a match is found increment the matching keyword in the hashtable. * Return zero on success, non-zero on out of memory . */ int vi_counter_incr_matchtable(struct hashtable *ht, char *s, char **t) { while(*t) { int res; if ((*t)[0] == '\0' || strstr(s, *t) != NULL) { char *key = *(t+1) ? *(t+1) : *t; res = vi_counter_incr(ht, key); if (res == 0) return 1; return 0; } t += 2; } return 0; } /* Process Operating Systems populating the relative hash table. * Return non-zero on out of memory. */ int vi_process_os(struct vih *vih, char *agent) { /* Order may matter. */ char *oslist[] = { "Windows", NULL, "Win98", "Windows", "Win95", "Windows", "WinNT", "Windows", "Win32", "Windows", "Linux", NULL, "-linux-", "Linux", "Macintosh", NULL, "Mac_PowerPC", "Macintosh", "SunOS", NULL, "FreeBSD", NULL, "OpenBSD", NULL, "NetBSD", NULL, "BEOS", NULL, "", "Unknown", NULL, NULL, }; return vi_counter_incr_matchtable(&vih->os, agent, oslist); } /* Process browsers information. */ int vi_process_browsers(struct vih *vih, char *agent) { /* Note that the order matters. For example Safari * send an user agent where there is the string "Gecko" * so it must be before Gecko. */ char *browserslist[] = { "Opera", NULL, "MSIE 4", "Explorer 4.x", "MSIE 5", "Explorer 5.x", "MSIE 6", "Explorer 6.x", "MSIE", "Explorer unknown version", "Safari", NULL, "Konqueror", NULL, "Galeon", NULL, "Firefox", NULL, "MultiZilla", NULL, "Gecko", "Other Mozilla based", "Wget", NULL, "Lynx", NULL, "Links ", "Links", "ELinks ", "Links", "Elinks ", "Links", "w3m", "W3M", "NATSU-MICAN", NULL, "msnbot", "MSNbot", "Slurp", "Yahoo Slurp", "Jeeves", "Ask Jeeves", "ZyBorg", NULL, "asteria", NULL, "contype", "Explorer", "Gigabot", NULL, "Windows-Media-Player", "Windows-MP", "NSPlayer", NULL, "Googlebot", "GoogleBot", "googlebot", "GoogleBot", "", "Unknown", NULL, NULL, }; return vi_counter_incr_matchtable(&vih->browsers, agent, browserslist); } /* Process req/agents to get information about pages retrivied by Google. * Return non-zero on out of memory. */ int vi_process_googled(struct vih *vih, char *req, char *agent, time_t age) { if (vi_is_googlebot_agent(agent)) { return vi_replace_if_newer(&vih->googled, req, age); } else if (vi_is_adsensebot_agent(agent)) { return vi_replace_if_newer(&vih->adsensed, req, age); } return 0; } /* Process screen resolution and color depth info, if the javascript * code needed was inserted in the pages (see the README file). */ int vi_process_screen_info(struct vih *vih, char *req) { char *p; if ((p = strstr(req, "visitors-screen-res-check.jpg?"))) { char buf[64]; p += 30; if (p[0] == '\0' || strstr(p, "undefined")) goto parseerror; vi_strlcpy(buf, p, 64); /* The string is somethink like: 1024x768x32, so we * search for the second 'x' char. */ p = strchr(buf,'x'); if (!p) goto parseerror; p = strchr(p+1,'x'); if (!p) goto parseerror; *p = '\0'; p++; /* Populate the screen resolution hash table */ if (vi_counter_incr(&vih->screenres, buf) == 0) return 1; /* ... and the screen color depth one. */ if (vi_counter_incr(&vih->screendepth, p) == 0) return 1; } parseerror: return 0; } /* Process accesses with the referer from google. * This is used to populate the keyphrases hashtable. * TODO: url decoding */ int vi_process_google_keyphrases(struct vih *vih, char *ref, time_t age) { char *s, *p, *e; int res, page; char urldecoded[VI_LINE_MAX]; char buf[64]; if (!vi_is_google_link(ref)) return 0; /* Try to process gogoe human language info first. */ if (Config_process_google_human_language) { s = strstr(ref+18, "&hl="); if (s == NULL) s = strstr(ref+18, "?hl="); if (s && s[4] && s[5]) { buf[0] = s[4]; buf[1] = s[5]; buf[2] = '\0'; if (vi_counter_incr(&vih->googlehumanlanguage, buf) == 0) return 1; } } /* It's possible to start the search for the query 18 chars * after the start of the referer because all the * google links will start with "http://www.google.". */ if ((s = strstr(ref+18, "?q=")) == NULL && (s = strstr(ref+18, "&q=")) == NULL) return 0; if ((p = strstr(ref+18, "&start=")) == NULL) p = strstr(ref+18, "?start="); if ((e = strchr(s+3, '&')) != NULL) *e = '\0'; if (p && (e = strchr(p+7, '&')) != NULL) *e = '\0'; if (!strncmp(s+3, "cache:", 6)) return !vi_counter_incr(&vih->googlekeyphrases, "Google Cache Access"); vi_urldecode(urldecoded, s+3, VI_LINE_MAX); vi_strtolower(urldecoded); page = p ? (1+(atoi(p+7)/10)) : 1; snprintf(buf, 64, " (page %d)", page); buf[63] = '\0'; vi_strlcat(urldecoded, buf, VI_LINE_MAX); res = vi_counter_incr(&vih->googlekeyphrases, urldecoded); if (e) *e = '&'; if (res == 0) return 1; /* Process keyphrases by first time */ if (Config_process_google_keyphrases_age) { if (vi_replace_if_older(&vih->googlekeyphrasesage, urldecoded, age)) return 1; } return 0; } /* Process robots information. For visitors every client accessing * to robots.txt is considered a robot. * Returns 1 on out of memory, otherwise zero is returned. */ int vi_process_robots(struct vih *vih, char *req, char *agent) { if (strncmp(req, "/robots.txt", 11) != 0) return 0; if (strstr(agent, "MSIECrawler")) return 0; return !vi_counter_incr(&vih->robots, agent); } /* Process referer -> request pairs for web trails */ int vi_process_web_trails(struct vih *vih, char *ref, char *req) { int res, plen, google; char buf[VI_LINE_MAX]; char *src; if (vi_is_image(req)) return 0; plen = vi_is_internal_link(ref); google = vi_is_google_link(ref); if (plen) { src = (ref[plen] == '\0') ? "/" : ref+plen; } else if (google) { if (Config_graphviz_ignorenode_google) return 0; src = "Google"; } else if (ref[0] != '\0') { if (Config_graphviz_ignorenode_external) return 0; src = "External Link"; } else { if (Config_graphviz_ignorenode_noreferer) return 0; src = "No Referer"; } if (!strcmp(src, req)) return 0; /* avoid self references */ snprintf(buf, VI_LINE_MAX, "%s -> %s", src, req); buf[VI_LINE_MAX-1] = '\0'; res = vi_counter_incr(&vih->trails, buf); if (res == 0) return 1; return 0; } /* Process Top Level Domains. * Returns zero on success. Non zero is returned on out of memory. */ int vi_process_tld(struct vih *vih, char *hostname) { char *tld; int res; if (vi_is_numeric_address(hostname)) { tld = "numeric IP"; } else { tld = strrchr(hostname, '.'); if (!tld) return 0; tld++; } res = vi_counter_incr(&vih->tld, tld); if (res == 0) return 1; return 0; } /* Match a log line against --grep and --exclude patters to check * if the line must be processed or not. */ int vi_match_line(char *line) { int i; for (i = 0; i < Config_grep_pattern_num; i++) { char *pattern = Config_grep_pattern[i].pattern; int nocase = 1; /* Patterns starting with 'cs:' are matched in a case-sensitive * way after the 'cs:' prefix is discarded. */ if (pattern[0] == 'c' && pattern[1] == 's' && pattern[2] == ':') { nocase = 0; pattern += 3; } if (vi_match(Config_grep_pattern[i].pattern, line, nocase)) { if (Config_grep_pattern[i].type == VI_PATTERNTYPE_EXCLUDE) return 0; } else { if (Config_grep_pattern[i].type == VI_PATTERNTYPE_GREP) return 0; } } return 1; } /* Process a line of log. Returns non-zero on error. */ int vi_process_line(struct vih *vih, char *l) { struct logline ll; char origline[VI_LINE_MAX]; /* Test the line against --grep --exclude patterns before * to process it. */ if (Config_grep_pattern_num) { if (vi_match_line(l) == 0) return 0; /* No match? skip. */ } vih->processed++; /* Take a copy of the original log line before to * copy it. Will be useful for some processing. * Do it only if required in order to speedup. */ if (Config_process_error404 || Config_debug) vi_strlcpy(origline, l, VI_LINE_MAX); /* Split the line and run all the selected processing. */ if (vi_parse_line(&ll, l) == 0) { int seen, is404; /* We process 404 errors first, in order to skip * all the other reports if --ignore-404 option is active. */ if (Config_process_error404 && vi_process_error404(vih, origline, ll.req, &is404)) goto oom; /* Process screen info if needed. */ if (Config_process_screen_info && is404) if (vi_process_screen_info(vih, ll.req)) goto oom; /* 404 error AND --ignore-404? Stop processing of this line. */ if (Config_ignore_404 && is404) return 0; /* Now it's time to process unique visitors. The 'save' * local var saves if this log line is about a new visit * or not. Some report is generated only against the first * line of every visitor, other reports are generated * for every single log line. */ if (vi_process_visitors_per_day(vih, ll.host, ll.agent, ll.date, ll.ref, ll.req, &seen)) goto oom; /* The following are processed for every log line */ if (vi_process_page_request(vih, ll.req)) goto oom; if (Config_process_google && vi_process_googled(vih, ll.req, ll.agent, ll.time)) goto oom; if (Config_process_web_trails && vi_process_web_trails(vih, ll.ref, ll.req)) goto oom; if (Config_process_google_keyphrases && vi_process_google_keyphrases(vih, ll.ref, ll.time)) goto oom; /* The following are processed only for new visits */ if (seen) return 0; vi_process_date_and_hour(vih, (ll.tm.tm_wday+6)%7, ll.tm.tm_hour); vi_process_month_and_day(vih, ll.tm.tm_mon, ll.tm.tm_mday-1); if (vi_process_referer(vih, ll.ref, ll.time)) goto oom; if (Config_process_agents && vi_process_agents(vih, ll.agent)) goto oom; if (Config_process_os && vi_process_os(vih, ll.agent)) goto oom; if (Config_process_browsers && vi_process_browsers(vih, ll.agent)) goto oom; if (Config_process_tld && vi_process_tld(vih, ll.host)) goto oom; if (Config_process_robots && vi_process_robots(vih, ll.req, ll.agent)) goto oom; return 0; } else { vih->invalid++; if (Config_debug) fprintf(stderr, "Invalid line: %s\n", origline); return 0; } oom: vi_set_error(vih, "Out of memory processing data"); return 1; } /* Process the specified log file. Returns zero on success. * On error non zero is returned and an error is set in the handle. */ int vi_scan(struct vih *vih, char *filename) { FILE *fp; char buf[VI_LINE_MAX]; int use_stdin = 0; if (filename[0] == '-' && filename[1] == '\0') { /* If we are in stream mode, just return. Stdin * is implicit in this mode and will be read * after all the other files are processed. */ if (Config_stream_mode) return 0; fp = stdin; use_stdin = 1; } else { if ((fp = fopen(filename, "r")) == NULL) { vi_set_error(vih, "Unable to open '%s': '%s'", filename, strerror(errno)); return 1; } } while (fgets(buf, VI_LINE_MAX, fp) != NULL) { if (vi_process_line(vih, buf)) { fclose(fp); fprintf(stderr, "%s: %s\n", filename, vi_get_error(vih)); return 1; } } if (!use_stdin) fclose(fp); vih->endt = time(NULL); return 0; } /* Postprocessing of pageviews per visit data. * The source hashtable entries are in the form: uniqe-visitor -> pageviews. * After the postprocessing we obtain another hashtable in the form: * pageviews-range -> quantity. This hashtable can be used directly * with generic output functions to generate the output. */ int vi_postprocess_pageviews(struct vih *vih) { void **table; int len = ht_used(&vih->pageviews), i; if ((table = ht_get_array(&vih->pageviews)) == NULL) { fprintf(stderr, "Out of memory in vi_postprocess_pageviews()\n"); return 1; } /* Run the hashtable in order to populate 'pageviews_grouped' */ for (i = 0; i < len; i++) { int pv = (long) table[(i*2)+1]; /* pageviews of visit */ int res; char *key; if (pv == 1) key = "1"; else if (pv == 2) key = "2"; else if (pv == 3) key = "3"; else if (pv == 4) key = "4"; else if (pv == 5) key = "5"; else if (pv == 6) key = "6"; else if (pv == 7) key = "7"; else if (pv == 8) key = "8"; else if (pv == 9) key = "9"; else if (pv == 10) key = "10"; else if (pv >= 11 && pv <= 20) key = "11-20"; else if (pv >= 21 && pv <= 30) key = "21-30"; else key = "> 30"; res = vi_counter_incr(&vih->pageviews_grouped, key); if (res == 0) { free(table); return 1; /* out of memory */ } } free(table); return 0; } /* This function is called from vi_print_report() in order to * run some postprocessing to raw data collected needed to generate reports. */ int vi_postprocess(struct vih *vih) { if (vi_postprocess_pageviews(vih)) goto oom; return 0; oom: vi_set_error(vih, "Out of memory"); return 1; } /* ---------------------------- text output module -------------------------- */ void om_text_print_header(FILE *fp) { fp = fp; return; } void om_text_print_footer(FILE *fp) { fp = fp; return; } void om_text_print_title(FILE *fp, char *title) { fprintf(fp, "=== %s ===\n", title); } void om_text_print_subtitle(FILE *fp, char *subtitle) { fprintf(fp, "--- %s\n", subtitle); } void om_text_print_numkey_info(FILE *fp, char *key, int val) { fprintf(fp, "* %s: %d\n", key, val); } void om_text_print_keykey_entry(FILE *fp, char *key1, char *key2, int num) { fprintf(fp, "%d) %s: %s\n", num, key1, key2); } void om_text_print_numkey_entry(FILE *fp, char *key, int val, char *link, int num) { link = link; /* avoid warning. Text output don't use this argument. */ fprintf(fp, "%d) %s: %d\n", num, key, val); } /* Print a bar, c1 and c2 are the colors of the left and right parts. * Max is the maximum value of the bar, the bar length is printed * to be porportional to max. tot is the "total" needed to compute * the precentage value. */ void om_text_print_bar(FILE *fp, int max, int tot, int this, int cols, char c1, char c2) { int l; float p; char *bar; if (tot == 0) tot++; if (max == 0) max++; l = ((float)(cols*this))/max; p = ((float)(100*this))/tot; bar = malloc(cols+1); if (!bar) return; memset(bar, c2, cols+1); memset(bar, c1, l); bar[cols] = '\0'; fprintf(fp, "%s %02.1f%%", bar, p); free(bar); } void om_text_print_numkeybar_entry(FILE *fp, char *key, int max, int tot, int this) { fprintf(fp, " %-12s: %-9d |", key, this); om_text_print_bar(fp, max, tot, this, 44, '#', ' '); fprintf(fp, "\n"); } void om_text_print_numkeycomparativebar_entry(FILE *fp, char *key, int tot, int this) { fprintf(fp, " %s: %-10d |", key, this); om_text_print_bar(fp, tot, tot, this, 44, '#', '.'); fprintf(fp, "\n"); } void om_text_print_bidimentional_map(FILE *fp, int xlen, int ylen, char **xlabel, char **ylabel, int *value) { char *asciipal = " .-+#"; int pallen = strlen(asciipal); int x, y, l, max = 0; /* Get the max value */ l = xlen*ylen; for (x = 0; x < l; x++) if (max < value[x]) max = value[x]; if (max == 0) max++; /* avoid division by zero */ /* print the map */ for (y = 0; y < ylen; y++) { fprintf(fp, "%15s: ", ylabel[y]); for (x = 0; x < xlen; x++) { int coloridx; int val = value[(y*xlen)+x]; coloridx = ((pallen-1)*val)/max; fputc(asciipal[coloridx], fp); } fprintf(fp, "\n"); } fprintf(fp, "\n"); /* print the x-labels in vertical */ { char **p = malloc(sizeof(char*)*xlen); /* The 'p' pointers array is initialized at the * start of all the x-labels. */ for (x = 0; x < xlen; x++) p[x] = xlabel[x]; while(1) { int sentinel = 0; fprintf(fp, "%15s ", ""); for (x = 0; x < xlen; x++) { if (*(p[x]) != '\0') { fputc(*(p[x]), fp); p[x]++; sentinel++; } else { fputc(' ', fp); } } fputc('\n', fp); if (sentinel == 0) break; } free(p); } } void om_text_print_hline(FILE *fp) { fprintf(fp, "\n"); } void om_text_print_credits(FILE *fp) { fprintf(fp, "Statistics generated with VISITORS version %s\n" "http://www.hping.org/visitors for more information\n", VI_VERSION_STR); } void om_text_print_report_link(FILE *fp, char *report) { fprintf(fp, "-> %s\n", report); return; } struct outputmodule OutputModuleText = { om_text_print_header, om_text_print_footer, om_text_print_title, om_text_print_subtitle, om_text_print_numkey_info, om_text_print_keykey_entry, om_text_print_numkey_entry, om_text_print_numkeybar_entry, om_text_print_numkeycomparativebar_entry, om_text_print_bidimentional_map, om_text_print_hline, om_text_print_credits, om_text_print_report_link, }; /* ---------------------------- html output module -------------------------- */ /* Use html entities for special chars. Abbreviates at 'maxlen' if needed. */ void om_html_entities_abbr(FILE *fp, char *s, int maxlen) { while(*s) { if (maxlen-- == 0) { fprintf(fp, "..."); break; } switch(*s) { case '\'': fprintf(fp, "'"); break; case '"': fprintf(fp, """); break; case '&': fprintf(fp, "&"); break; case '<': fprintf(fp, "<"); break; case '>': fprintf(fp, ">"); break; default: fputc(*s, fp); break; } s++; } } /* A wrapper to om_html_entities_abbr() with a fixed abbreviation length */ void om_html_entities(FILE *fp, char *s) { om_html_entities_abbr(fp, s, VI_HTML_ABBR_LEN); } void om_html_print_header(FILE *fp) { fprintf(fp, "\n" "\n" "\n" "\n" "\n" ); } void om_html_print_footer(FILE *fp) { fprintf(fp, "
\n"); } void om_html_print_title(FILE *fp, char *title) { fprintf(fp, "", title); om_html_entities(fp, title); fprintf(fp, "\n"); } void om_html_print_subtitle(FILE *fp, char *subtitle) { fprintf(fp, ""); om_html_entities(fp, subtitle); fprintf(fp, "\n"); } void om_html_print_numkey_info(FILE *fp, char *key, int val) { fprintf(fp, ""); om_html_entities(fp, key); fprintf(fp, " %d", val); fprintf(fp, "\n"); } void om_html_print_keykey_entry(FILE *fp, char *key1, char *key2, int num) { fprintf(fp, ""); fprintf(fp, "%d)", num); fprintf(fp, ""); om_html_entities(fp, key1); fprintf(fp, ""); if (!strncmp(key2, "http://", 7)) { fprintf(fp, "", key2); om_html_entities(fp, key2); fprintf(fp, ""); } else { om_html_entities(fp, key2); } fprintf(fp, "\n"); } void om_html_print_numkey_entry(FILE *fp, char *key, int val, char *link, int num) { fprintf(fp, ""); fprintf(fp, "%d)", num); fprintf(fp, ""); fprintf(fp, "%d", val); fprintf(fp, ""); if (link != NULL) { fprintf(fp, "", link); om_html_entities(fp, key); fprintf(fp, ""); } else if (!strncmp(key, "http://", 7)) { fprintf(fp, "", key); om_html_entities(fp, key); fprintf(fp, ""); } else { om_html_entities(fp, key); } fprintf(fp, "\n"); } void om_html_print_bar(FILE *fp, int l, char *leftclass, char *rightclass) { fprintf(fp, "\n"); fprintf(fp, "\n", leftclass, l, l ? " " : ""); fprintf(fp, "\n", rightclass, 100-l, (l!=100) ? " " : ""); fprintf(fp, "
%s%s
\n"); } void om_html_print_numkeybar_entry(FILE *fp, char *key, int max, int tot, int this) { int l, weekend; float p; if (tot == 0) tot++; if (max == 0) max++; l = ((float)(100*this))/max; p = ((float)(100*this))/tot; weekend = vi_is_weekend(key); if (weekend) fprintf(fp, ""); else fprintf(fp, ""); om_html_entities(fp, key); fprintf(fp, "   "); fprintf(fp, "%d (%02.1f%%)", this, p); fprintf(fp, ""); om_html_print_bar(fp, l, "barfill", "barempty"); fprintf(fp, "\n"); } void om_html_print_numkeycomparativebar_entry(FILE *fp, char *key, int tot, int this) { int l, weekend; float p; if (tot == 0) tot++; p = ((float)(100*this))/tot; l = (int) p; weekend = vi_is_weekend(key); if (weekend) fprintf(fp, ""); else fprintf(fp, ""); om_html_entities(fp, key); fprintf(fp, "   "); fprintf(fp, "%d (%02.1f%%)", this, p); fprintf(fp, ""); om_html_print_bar(fp, l, "barleft", "barright"); fprintf(fp, "\n"); } void om_html_print_bidimentional_map(FILE *fp, int xlen, int ylen, char **xlabel, char **ylabel, int *value) { int x, y, l, max = 0; /* Get the max value */ l = xlen*ylen; for (x = 0; x < l; x++) if (max < value[x]) max = value[x]; if (max == 0) max++; /* avoid division by zero */ /* print the map */ fprintf(fp, ""); fprintf(fp, ""); for (y = 0; y < ylen; y++) { fprintf(fp, ""); fprintf(fp, "", ylabel[y]); for (x = 0; x < xlen; x++) { int r, g, b; int val = value[(y*xlen)+x]; r = (0xAA*val)/max; g = (0xBB*val)/max; b = (0xFF*val)/max; fprintf(fp, "\n", r, g, b); } fprintf(fp, "\n"); } fprintf(fp, ""); for (x = 0; x < xlen; x++) { fprintf(fp, "", xlabel[x]); } fprintf(fp, "
%s 
 %s
"); } void om_html_print_hline(FILE *fp) { fprintf(fp, " "); } void om_html_print_credits(FILE *fp) { fprintf(fp, "Statistics generated with VISITORS Web Log Analyzer version %s\n", VI_VERSION_STR); } void om_html_print_report_link(FILE *fp, char *report) { fprintf(fp, "", report); om_html_entities(fp, report); fprintf(fp, "\n"); return; } struct outputmodule OutputModuleHtml = { om_html_print_header, om_html_print_footer, om_html_print_title, om_html_print_subtitle, om_html_print_numkey_info, om_html_print_keykey_entry, om_html_print_numkey_entry, om_html_print_numkeybar_entry, om_html_print_numkeycomparativebar_entry, om_html_print_bidimentional_map, om_html_print_hline, om_html_print_credits, om_html_print_report_link, }; /* ---------------------------------- output -------------------------------- */ void vi_print_statistics(struct vih *vih) { time_t elapsed = vih->endt - vih->startt; if (elapsed == 0) elapsed++; fprintf(stderr, "--\n%d lines processed in %ld seconds\n" "%d invalid lines, %d blacklisted referers\n", vih->processed, (long) elapsed, vih->invalid, vih->blacklisted); } void vi_print_hours_report(FILE *fp, struct vih *vih) { int i, max = 0, tot = 0; for (i = 0; i < 24; i++) { if (vih->hour[i] > max) max = vih->hour[i]; tot += vih->hour[i]; } Output->print_title(fp, "Hours distribution"); Output->print_subtitle(fp, "Percentage of hits in every hour of the day"); for (i = 0; i < 24; i++) { char buf[8]; sprintf(buf, "%02d", i); Output->print_numkeybar_entry(fp, buf, max, tot, vih->hour[i]); } } void vi_print_weekdays_report(FILE *fp, struct vih *vih) { int i, max = 0, tot = 0; for (i = 0; i < 7; i++) { if (vih->weekday[i] > max) max = vih->weekday[i]; tot += vih->weekday[i]; } Output->print_title(fp, "Weekdays distribution"); Output->print_subtitle(fp, "Percentage of hits in every day of the week"); for (i = 0; i < 7; i++) { Output->print_numkeybar_entry(fp, vi_wdname[i], max, tot, vih->weekday[i]); } } /* Generic function for qsort(3) called to sort a table. * this function is actually only used by the following wrappers. */ int qsort_cmp_dates_generic(const void *a, const void *b, int off, int mul) { time_t ta, tb; void **A = (void**) a; void **B = (void**) b; char *dateA = (char*) *(A+off); char *dateB = (char*) *(B+off); ta = parse_date(dateA, NULL); tb = parse_date(dateB, NULL); if (ta == (time_t)-1 && tb == (time_t)-1) return 0; if (ta == (time_t)-1) return 1*mul; if (tb == (time_t)-1) return -1*mul; if (ta > tb) return 1*mul; if (ta < tb) return -1*mul; return 0; } /* Compare dates in the log format: hashtable key part version */ int qsort_cmp_dates_key(const void *a, const void *b) { return qsort_cmp_dates_generic(a, b, 0, 1); } /* Compare dates (only the month/year part) in the log format: * hashtable key part version */ int qsort_cmp_months_key(const void *a, const void *b) { int ret; char dateA[VI_DATE_MAX]; char dateB[VI_DATE_MAX]; void *savedA, *savedB; /* backups of the original pointers */ void **A = (void**) a; void **B = (void**) b; /* We use an hack here, in order to call qsort_cmp_dates_generic * even in this case, we substitute the hashtable entries * with versions of the strings prefixed with "01", so they * will be parseble by parse_date(). * In pratice for "May/2004" we instead put "01/May/2004" and so on. */ savedA = *A; savedB = *B; dateA[0] = dateB[0] = '0'; dateA[1] = dateB[1] = '1'; dateA[2] = dateB[2] = '/'; dateA[3] = dateB[3] = '\0'; vi_strlcat(dateA, (char*)*A, VI_DATE_MAX); vi_strlcat(dateB, (char*)*B, VI_DATE_MAX); *A = dateA; *B = dateB; ret = qsort_cmp_dates_generic(a, b, 0, 1); /* Restore */ *A = savedA; *B = savedB; return ret; } /* Compare dates in the log format: hashtable value part version. * this sorts in reverse order, more recent dates first. */ int qsort_cmp_dates_value(const void *a, const void *b) { return qsort_cmp_dates_generic(a, b, 1, -1); } int qsort_cmp_long_value(const void *a, const void *b) { void **A = (void**) a; void **B = (void**) b; long la = (long) *(A+1); long lb = (long) *(B+1); if (la > lb) return -1; if (lb > la) return 1; return 0; } int qsort_cmp_time_value(const void *a, const void *b) { void **A = (void**) a; void **B = (void**) b; time_t ta = (time_t) *(A+1); time_t tb = (time_t) *(B+1); if (ta > tb) return -1; if (tb > ta) return 1; return 0; } void vi_print_visits_report(FILE *fp, struct vih *vih) { int days = ht_used(&vih->date), i, tot = 0, max = 0; int months; void **table; Output->print_title(fp, "Unique visitors in each day"); Output->print_subtitle(fp, "Multiple hits with the same IP, user agent and access day, are considered a single visit"); Output->print_numkey_info(fp, "Number of unique visitors", ht_used(&vih->visitors)); Output->print_numkey_info(fp, "Different days in logfile", ht_used(&vih->date)); if ((table = ht_get_array(&vih->date)) == NULL) { fprintf(stderr, "Out Of Memory in print_visits_report()\n"); return; } qsort(table, days, sizeof(void*)*2, qsort_cmp_dates_key); for (i = 0; i < days; i++) { long value = (long) table[(i*2)+1]; if (value > max) max = value; tot += value; } for (i = 0; i < days; i++) { char *key = table[i*2]; long value = (long) table[(i*2)+1]; Output->print_numkeybar_entry(fp, key, max, tot, value); } free(table); Output->print_hline(fp); /* Montly */ if (Config_process_monthly_visitors == 0) return; tot = max = 0; months = ht_used(&vih->month); Output->print_title(fp, "Unique visitors in each month"); Output->print_subtitle(fp, "Multiple hits with the same IP, user agent and access day, are considered a single visit"); Output->print_numkey_info(fp, "Number of unique visitors", ht_used(&vih->visitors)); Output->print_numkey_info(fp, "Different months in logfile", ht_used(&vih->month)); if ((table = ht_get_array(&vih->month)) == NULL) { fprintf(stderr, "Out Of Memory in print_visits_report()\n"); return; } qsort(table, months, sizeof(void*)*2, qsort_cmp_months_key); for (i = 0; i < months; i++) { long value = (long) table[(i*2)+1]; if (value > max) max = value; tot += value; } for (i = 0; i < months; i++) { char *key = table[i*2]; long value = (long) table[(i*2)+1]; Output->print_numkeybar_entry(fp, key, max, tot, value); } free(table); } /* A report to compare visits originating from google VS all the rest. */ void vi_print_googlevisits_report(FILE *fp, struct vih *vih) { int days = ht_used(&vih->date), i, months; void **table; Output->print_title(fp, "Unique visitors from Google in each day"); Output->print_subtitle(fp, "The red part of the bar expresses the percentage of visits originated from Google"); Output->print_numkey_info(fp, "Number of unique visitors", ht_used(&vih->visitors)); Output->print_numkey_info(fp, "Number of unique visitors from google", ht_used(&vih->googlevisitors)); Output->print_numkey_info(fp, "Different days in logfile", ht_used(&vih->date)); if ((table = ht_get_array(&vih->date)) == NULL) { fprintf(stderr, "Out Of Memory in print_visits_report()\n"); return; } qsort(table, days, sizeof(void*)*2, qsort_cmp_dates_key); for (i = 0; i < days; i++) { char *key = table[i*2]; long value = (long) table[(i*2)+1]; long googlevalue; googlevalue = vi_counter_val(&vih->googledate, key); Output->print_numkeycomparativebar_entry(fp, key, value, googlevalue); } free(table); Output->print_hline(fp); /* Montly */ if (Config_process_monthly_visitors == 0) return; months = ht_used(&vih->month); Output->print_title(fp, "Unique visitors from Google in each month"); Output->print_subtitle(fp, "The red part of the bar expresses the percentage of visits originated from Google"); Output->print_numkey_info(fp, "Number of unique visitors", ht_used(&vih->visitors)); Output->print_numkey_info(fp, "Number of unique visitors from google", ht_used(&vih->googlevisitors)); Output->print_numkey_info(fp, "Different months in logfile", ht_used(&vih->month)); if ((table = ht_get_array(&vih->month)) == NULL) { fprintf(stderr, "Out Of Memory in print_visits_report()\n"); return; } qsort(table, months, sizeof(void*)*2, qsort_cmp_months_key); for (i = 0; i < months; i++) { char *key = table[i*2]; long value = (long) table[(i*2)+1]; long googlevalue; googlevalue = vi_counter_val(&vih->googlemonth, key); Output->print_numkeycomparativebar_entry(fp, key, value, googlevalue); } free(table); } void vi_print_generic_keyval_report(FILE *fp, char *title, char *subtitle, char *info, int maxlines, struct hashtable *ht, int(*compar)(const void *, const void *)) { int items = ht_used(ht), i; void **table; Output->print_title(fp, title); Output->print_subtitle(fp, subtitle); Output->print_numkey_info(fp, info, items); if ((table = ht_get_array(ht)) == NULL) { fprintf(stderr, "Out of memory in print_generic_report()\n"); return; } qsort(table, items, sizeof(void*)*2, compar); for (i = 0; i < items; i++) { char *key = table[i*2]; long value = (long) table[(i*2)+1]; if (i >= maxlines) break; if (key[0] == '\0') Output->print_numkey_entry(fp, "none", value, NULL, i+1); else Output->print_numkey_entry(fp, key, value, NULL, i+1); } free(table); } void vi_print_generic_keyvalbar_report(FILE *fp, char *title, char *subtitle, char *info, int maxlines, struct hashtable *ht, int(*compar)(const void *, const void *)) { int items = ht_used(ht), i, max = 0, tot = 0; void **table; Output->print_title(fp, title); Output->print_subtitle(fp, subtitle); Output->print_numkey_info(fp, info, items); if ((table = ht_get_array(ht)) == NULL) { fprintf(stderr, "Out of memory in print_generic_report()\n"); return; } qsort(table, items, sizeof(void*)*2, compar); for (i = 0; i < items; i++) { long value = (long) table[(i*2)+1]; tot += value; if (value > max) max = value; } for (i = 0; i < items; i++) { char *key = table[i*2]; long value = (long) table[(i*2)+1]; if (i >= maxlines) break; if (key[0] == '\0') Output->print_numkeybar_entry(fp, "none", max, tot, value); else Output->print_numkeybar_entry(fp, key, max, tot, value); } free(table); } /* This is similar to the generic key/val report, but * different enough to be better served by a specific function. */ void vi_print_keyphrases_report(FILE *fp, char *title, char *subtitle, char *info, int maxlines, struct hashtable *ht, int(*compar)(const void *, const void *)) { int items = ht_used(ht), i; void **table; Output->print_title(fp, title); Output->print_subtitle(fp, subtitle); Output->print_numkey_info(fp, info, items); if ((table = ht_get_array(ht)) == NULL) { fprintf(stderr, "Out of memory in print_keyphrases_report()\n"); return; } qsort(table, items, sizeof(void*)*2, compar); for (i = 0; i < items; i++) { char *key = table[i*2]; long value = (long) table[(i*2)+1]; if (i >= maxlines) break; if (key[0] == '\0') Output->print_numkey_entry(fp, "none", value, NULL, i+1); else { char *p; char link[VI_LINE_MAX]; char aux[VI_LINE_MAX]; char encodedkey[VI_LINE_MAX]; vi_strlcpy(link, "http://www.google.com/search?q=", VI_LINE_MAX); vi_strlcpy(aux, key, VI_LINE_MAX); p = strrchr(aux, '('); if (p) { if (p > aux) p--; /* seek the space on left */ *p = '\0'; } vi_urlencode(encodedkey, aux, VI_LINE_MAX); vi_strlcat(link, encodedkey, VI_LINE_MAX); Output->print_numkey_entry(fp, key, value, link, i+1); } } free(table); } void vi_print_referers_report(FILE *fp, struct vih *vih) { vi_print_generic_keyval_report( fp, "Referers", "Referers ordered by visits (google excluded)", "Different referers", Config_max_referers, &vih->referers, qsort_cmp_long_value); } void vi_print_pages_report(FILE *fp, struct vih *vih) { vi_print_generic_keyval_report( fp, "Requested pages", "Page requests ordered by hits", "Different pages requested", Config_max_pages, &vih->pages, qsort_cmp_long_value); } void vi_print_error404_report(FILE *fp, struct vih *vih) { vi_print_generic_keyval_report( fp, "404 Errors", "Requests for missing documents", "Different missing documents requested", Config_max_error404, &vih->error404, qsort_cmp_long_value); } void vi_print_pageviews_report(FILE *fp, struct vih *vih) { vi_print_generic_keyvalbar_report( fp, "Pageviews per visit", "Number of pages requested per visit", "Only documents are counted (not images). Reported ranges:", 100, &vih->pageviews_grouped, qsort_cmp_long_value); } void vi_print_images_report(FILE *fp, struct vih *vih) { vi_print_generic_keyval_report( fp, "Requested images and CSS", "Images and CSS requests ordered by hits", "Different images and CSS requested", Config_max_images, &vih->images, qsort_cmp_long_value); } void vi_print_agents_report(FILE *fp, struct vih *vih) { vi_print_generic_keyval_report( fp, "User agents", "The entire user agent string ordered by visits", "Different agents", Config_max_agents, &vih->agents, qsort_cmp_long_value); } void vi_print_os_report(FILE *fp, struct vih *vih) { vi_print_generic_keyvalbar_report( fp, "Operating Systems", "Operating Systems by visits", "Different operating systems listed", 100, &vih->os, qsort_cmp_long_value); } void vi_print_browsers_report(FILE *fp, struct vih *vih) { vi_print_generic_keyvalbar_report( fp, "Browsers", "Browsers used by visits", "Different browsers listed", 100, &vih->browsers, qsort_cmp_long_value); } void vi_print_trails_report(FILE *fp, struct vih *vih) { vi_print_generic_keyval_report( fp, "Web trails", "Referer -> Target common moves", "Total number of trails", Config_max_trails, &vih->trails, qsort_cmp_long_value); } void vi_print_google_keyphrases_report(FILE *fp, struct vih *vih) { vi_print_keyphrases_report( fp, "Google Keyphrases", "Keyphrases used in google searches ordered by visits", "Total number of keyphrases", Config_max_google_keyphrases, &vih->googlekeyphrases, qsort_cmp_long_value); } void vi_print_tld_report(FILE *fp, struct vih *vih) { vi_print_generic_keyvalbar_report( fp, "Domains", "Top Level Domains sorted by visits", "Total number of Top Level Domains", Config_max_tld, &vih->tld, qsort_cmp_long_value); } void vi_print_robots_report(FILE *fp, struct vih *vih) { vi_print_generic_keyval_report( fp, "Robots and web spiders", "Agents requesting robots.txt. MSIECrawler excluded.", "Total number of different robots", Config_max_robots, &vih->robots, qsort_cmp_long_value); } /* Print a generic report where the two report items are strings * (usually url and date). Used to print the 'googled' and 'referers age' * reports. */ void vi_print_generic_keytime_report(FILE *fp, char *title, char *subtitle, char *info, int maxlines, struct hashtable *ht, int(*compar)(const void *, const void *)) { int items = ht_used(ht), i; void **table; Output->print_title(fp, title); Output->print_subtitle(fp, subtitle); Output->print_numkey_info(fp, info, items); if ((table = ht_get_array(ht)) == NULL) { fprintf(stderr, "Out Of Memory in print_generic_keytime_report()\n"); return; } qsort(table, items, sizeof(void*)*2, compar); for (i = 0; i < items; i++) { struct tm *tm; char ftime[1024]; char *url = table[i*2]; time_t time = (time_t) table[(i*2)+1]; if (i >= maxlines) break; tm = localtime(&time); if (tm) { ftime[0] = '\0'; strftime(ftime, 1024, "%d/%b/%Y", tm); Output->print_keykey_entry(fp, ftime, (url[0] == '\0') ? "none" : url, i+1); } } free(table); } void vi_print_googled_report(FILE *fp, struct vih *vih) { vi_print_generic_keytime_report( fp, "Googled pages", "Pages accessed by the Google crawler, last access reported", "Number of pages googled", Config_max_googled, &vih->googled, qsort_cmp_time_value); } void vi_print_adsensed_report(FILE *fp, struct vih *vih) { vi_print_generic_keytime_report( fp, "Adsensed pages", "Pages accessed by the Adsense crawler, last access reported", "Number of pages adsensed", Config_max_adsensed, &vih->adsensed, qsort_cmp_time_value); } void vi_print_referers_age_report(FILE *fp, struct vih *vih) { vi_print_generic_keytime_report( fp, "Referers by first time", "Referers ordered by first time date, newer on top (referers from google excluded)", "Different referers", Config_max_referers_age, &vih->referersage, qsort_cmp_time_value); } void vi_print_google_keyphrases_age_report(FILE *fp, struct vih *vih) { vi_print_generic_keytime_report( fp, "Google Keyphrases by first time", "Keyphrases ordered by first time date, newer on top", "Different referers", Config_max_google_keyphrases_age, &vih->googlekeyphrasesage, qsort_cmp_time_value); } void vi_print_google_human_language_report(FILE *fp, struct vih *vih) { vi_print_generic_keyval_report( fp, "Google Human Language", "The 'hl' field in the query string of google searches", "Different human languages", 1000, &vih->googlehumanlanguage, qsort_cmp_long_value); } void vi_print_screen_res_report(FILE *fp, struct vih *vih) { vi_print_generic_keyval_report( fp, "Screen resolution", "user screen width x height resolution", "Different resolutions", 1000, &vih->screenres, qsort_cmp_long_value); } void vi_print_screen_depth_report(FILE *fp, struct vih *vih) { vi_print_generic_keyval_report( fp, "Screen color depth", "user screen color depth in bits per pixel", "Different color depths", 1000, &vih->screendepth, qsort_cmp_long_value); } void vi_print_information_report(FILE *fp, struct vih *vih) { char buf[VI_LINE_MAX]; time_t now = time(NULL); snprintf(buf, VI_LINE_MAX, "Generated: %s", ctime(&now)); Output->print_title(fp, "General information"); Output->print_subtitle(fp, "Information about analyzed log files"); Output->print_subtitle(fp, buf); Output->print_numkey_info(fp, "Number of entries processed", vih->processed); Output->print_numkey_info(fp, "Number of invalid entries", vih->invalid); Output->print_numkey_info(fp, "Processing time in seconds", (vih->endt)-(vih->startt)); } void vi_print_report_links(FILE *fp) { void *l[] = { "Unique visitors in each day", NULL, "Unique visitors in each month", &Config_process_monthly_visitors, "Unique visitors from Google in each day", NULL, "Unique visitors from Google in each month", &Config_process_monthly_visitors, "Pageviews per visit", &Config_process_pageviews, "Weekday-Hour combined map", &Config_process_weekdayhour_map, "Month-Day combined map", &Config_process_monthday_map, "Requested pages", NULL, "Requested images and CSS", NULL, "Referers", NULL, "Referers by first time", &Config_process_referers_age, "Robots and web spiders", &Config_process_robots, "User agents", &Config_process_agents, "Operating Systems", &Config_process_os, "Browsers", &Config_process_browsers, "404 Errors", &Config_process_error404, "Domains", &Config_process_tld, "Googled pages", &Config_process_google, "Adsensed pages", &Config_process_google, "Google Keyphrases", &Config_process_google_keyphrases, "Google Keyphrases by first time", &Config_process_google_keyphrases_age, "Google Human Language", &Config_process_google_human_language, "Screen resolution", &Config_process_screen_info, "Screen color depth", &Config_process_screen_info, "Web trails", &Config_process_web_trails, "Weekday distribution", NULL, "Hours distribution", NULL, }; unsigned int i, num = 0; Output->print_title(fp, "Generated reports"); Output->print_subtitle(fp, "Click on the report name you want to see"); for (i = 0; i < sizeof(l)/sizeof(void*); i += 2) { int active = l[i+1] == NULL ? 1 : *((int*)l[i+1]); if (active) num++; } Output->print_numkey_info(fp, "Number of reports generated", num); for (i = 0; i < sizeof(l)/sizeof(void*); i += 2) { int active = l[i+1] == NULL ? 1 : *((int*)l[i+1]); if (active) Output->print_report_link(fp, (char*)l[i]); } } void vi_print_weekdayhour_map_report(FILE *fp, struct vih *vih) { char *xlabel[24] = { "00", "01", "02", "03", "04", "05", "06", "07", "08", "09", "10", "11", "12", "13", "14", "15", "16", "17", "18", "19", "20", "21", "22", "23"}; char **ylabel = vi_wdname; int j, minj = 0, maxj = 0; int *hw = (int*) vih->weekdayhour; char buf[VI_LINE_MAX]; /* Check idexes of minimum and maximum in the array. */ for (j = 0; j < 24*7; j++) { if (hw[j] > hw[maxj]) maxj = j; if (hw[j] < hw[minj]) minj = j; } Output->print_title(fp, "Weekday-Hour combined map"); Output->print_subtitle(fp, "Brighter means higher level of hits"); snprintf(buf, VI_LINE_MAX, "Hour with max traffic starting at %s %s:00 with hits", ylabel[maxj/24], xlabel[maxj%24]); Output->print_numkey_info(fp, buf, hw[maxj]); snprintf(buf, VI_LINE_MAX, "Hour with min traffic starting at %s %s:00 with hits", ylabel[minj/24], xlabel[minj%24]); Output->print_numkey_info(fp, buf, hw[minj]); Output->print_hline(fp); Output->print_bidimentional_map(fp, 24, 7, xlabel, ylabel, hw); } void vi_print_monthday_map_report(FILE *fp, struct vih *vih) { char *xlabel[31] = { "01", "02", "03", "04", "05", "06", "07", "08", "09", "10", "11", "12", "13", "14", "15", "16", "17", "18", "19", "20", "21", "22", "23", "24", "25", "26", "27", "28", "29", "30", "31"}; char *ylabel[12] = { "Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec", }; int j, minj = 0, maxj = 0; int *md = (int*) vih->monthday; char buf[VI_LINE_MAX]; /* Check idexes of minimum and maximum in the array. */ for (j = 0; j < 12*31; j++) { if (md[j] > md[maxj]) maxj = j; if (md[j] != 0 && (md[j] < md[minj] || md[minj] == 0)) minj = j; } Output->print_title(fp, "Month-Day combined map"); Output->print_subtitle(fp, "Brighter means higher level of hits"); snprintf(buf, VI_LINE_MAX, "Day with max traffic is %s %s with hits", ylabel[maxj/31], xlabel[maxj%31]); Output->print_numkey_info(fp, buf, md[maxj]); snprintf(buf, VI_LINE_MAX, "Day with min traffic is %s %s with hits", ylabel[minj/31], xlabel[minj%31]); Output->print_numkey_info(fp, buf, md[minj]); Output->print_hline(fp); Output->print_bidimentional_map(fp, 31, 12, xlabel, ylabel, md); } void vi_print_hline(FILE *fp) { Output->print_hline(fp); } void vi_print_credits(FILE *fp) { Output->print_credits(fp); } void vi_print_header(FILE *fp) { Output->print_header(fp); } void vi_print_footer(FILE *fp) { Output->print_footer(fp); } /* Generate the report writing it to the output file 'of'. * If op is NULL, output the report to standard output. * On success zero is returned. Otherwise the function returns * non-zero and set an error in the vih handler. */ int vi_print_report(char *of, struct vih *vih) { FILE *fp; if (of == NULL) { fp = stdout; } else { fp = fopen(of, "w"); if (fp == NULL) { vi_set_error(vih, "Writing the report to '%s': %s", of, strerror(errno)); return 1; } } /* Disable specific reports when there is no data. */ if (ht_used(&vih->screenres) == 0) Config_process_screen_info = 0; /* Do some data postprocessing needed to generate reports */ if (vi_postprocess(vih)) return 1; /* Report generation */ vi_print_header(fp); vi_print_credits(fp); vi_print_hline(fp); vi_print_information_report(fp, vih); vi_print_hline(fp); vi_print_report_links(fp); vi_print_hline(fp); vi_print_visits_report(fp, vih); vi_print_hline(fp); vi_print_googlevisits_report(fp, vih); vi_print_hline(fp); if (Config_process_weekdayhour_map) { vi_print_weekdayhour_map_report(fp, vih); vi_print_hline(fp); } if (Config_process_monthday_map) { vi_print_monthday_map_report(fp, vih); vi_print_hline(fp); } if (Config_process_pageviews) { vi_print_pageviews_report(fp, vih); vi_print_hline(fp); } vi_print_pages_report(fp, vih); vi_print_hline(fp); vi_print_images_report(fp, vih); vi_print_hline(fp); vi_print_referers_report(fp, vih); vi_print_hline(fp); if (Config_process_referers_age) { vi_print_referers_age_report(fp, vih); vi_print_hline(fp); } if (Config_process_robots) { vi_print_robots_report(fp, vih); vi_print_hline(fp); } if (Config_process_agents) { vi_print_agents_report(fp, vih); vi_print_hline(fp); } if (Config_process_os) { vi_print_os_report(fp, vih); vi_print_hline(fp); } if (Config_process_browsers) { vi_print_browsers_report(fp, vih); vi_print_hline(fp); } if (Config_process_error404) { vi_print_error404_report(fp, vih); vi_print_hline(fp); } if (Config_process_tld) { vi_print_tld_report(fp, vih); vi_print_hline(fp); } if (Config_process_google) { vi_print_googled_report(fp, vih); vi_print_hline(fp); vi_print_adsensed_report(fp, vih); vi_print_hline(fp); } if (Config_process_google_keyphrases) { vi_print_google_keyphrases_report(fp, vih); vi_print_hline(fp); } if (Config_process_google_keyphrases) { vi_print_google_keyphrases_age_report(fp, vih); vi_print_hline(fp); } if (Config_process_google_human_language) { vi_print_google_human_language_report(fp, vih); vi_print_hline(fp); } if (Config_process_screen_info) { vi_print_screen_res_report(fp, vih); vi_print_hline(fp); vi_print_screen_depth_report(fp, vih); vi_print_hline(fp); } if (Config_process_web_trails) { vi_print_trails_report(fp, vih); vi_print_hline(fp); } vi_print_weekdays_report(fp, vih); vi_print_hline(fp); vi_print_hours_report(fp, vih); vi_print_hline(fp); vi_print_credits(fp); vi_print_hline(fp); vi_print_footer(fp); if (of != NULL) fclose(fp); return 0; } /* ------------------------- graphviz graph generation ---------------------- */ void vi_print_graphviz(struct vih *vih) { int items = ht_used(&vih->trails), i, max = 0, tot = 0; void **table; printf("digraph webtrails {\n"); printf("\tgraph [splines=true overlap=false rankdir=LR]\n"); printf("\tnode [color=lightblue2,style=\"filled\"]\n"); printf("\tedge [style=bold]\n"); if ((table = ht_get_array(&vih->trails)) == NULL) { fprintf(stderr, "Out of memory in vi_print_graphviz()\n"); return; } qsort(table, items, sizeof(void*)*2, qsort_cmp_long_value); for (i = 0; i < items; i++) { long value = (long) table[(i*2)+1]; tot += value; if (i > Config_max_trails) continue; if (max < value) max = value; } if (max == 0) max = 1; /* avoid division by zero */ if (tot == 0) tot = 1; for (i = 0; i < items; i++) { int color; char *key = table[i*2]; char *t; long value = (long) table[(i*2)+1]; float percentage = ((float)value/tot)*100; if (i > Config_max_trails) break; color = (value*255)/max; t = strstr(key, " -> "); *t = '\0'; /* alter */ printf("\t\"%s\" -> \"%s\" [color=\"#%02X00%02X\" label=\"%.2f\"]\n", key, t+4, color, 255-color, percentage); *t = ' '; /* restore */ } if (!Config_graphviz_ignorenode_google) printf("\tGoogle [color=\"#c0ffc0\"]\n"); if (!Config_graphviz_ignorenode_external) printf("\t\"External Link\" [color=\"#c0ffc0\"]\n"); if (!Config_graphviz_ignorenode_noreferer) printf("\t\"No Referer\" [color=\"#c0ffc0\"]\n"); free(table); printf("}\n"); } /* -------------------------------- stream mode ----------------------------- */ void vi_stream_mode(struct vih *vih) { time_t lastupdate_t, lastreset_t, now_t; lastupdate_t = lastreset_t = time(NULL); while(1) { char buf[VI_LINE_MAX]; if (fgets(buf, VI_LINE_MAX, stdin) == NULL) { vi_sleep(1); continue; } if (vi_process_line(vih, buf)) { fprintf(stderr, "%s\n", vi_get_error(vih)); } now_t = time(NULL); /* update */ if ((now_t - lastupdate_t) >= Config_update_every) { lastupdate_t = now_t; if (vi_print_report(Config_output_file, vih)) { fprintf(stderr, "%s\n", vi_get_error(vih)); } } /* reset */ if (Config_reset_every && ((now_t - lastreset_t) >= Config_reset_every)) { lastreset_t = now_t; vi_reset(vih); } } } /* ----------------------------------- main --------------------------------- */ /* command line switche IDs */ enum { OPT_MAXREFERERS, OPT_MAXPAGES, OPT_MAXIMAGES, OPT_USERAGENTS, OPT_ALL, OPT_MAXLINES, OPT_GOOGLE, OPT_MAXGOOGLED, OPT_MAXUSERAGENTS, OPT_OUTPUT, OPT_VERSION, OPT_HELP, OPT_PREFIX, OPT_TRAILS, OPT_GOOGLEKEYPHRASES, OPT_GOOGLEKEYPHRASESAGE, OPT_MAXGOOGLEKEYPHRASES, OPT_MAXGOOGLEKEYPHRASESAGE, OPT_MAXTRAILS, OPT_GRAPHVIZ, OPT_WEEKDAYHOUR_MAP, OPT_MONTHDAY_MAP, OPT_REFERERSAGE, OPT_MAXREFERERSAGE, OPT_TAIL, OPT_TLD, OPT_MAXTLD, OPT_STREAM, OPT_OUTPUTFILE, OPT_UPDATEEVERY, OPT_RESETEVERY, OPT_OS, OPT_BROWSERS, OPT_ERROR404, OPT_MAXERROR404, OPT_TIMEDELTA, OPT_PAGEVIEWS, OPT_ROBOTS, OPT_MAXROBOTS, OPT_GRAPHVIZ_ignorenode_GOOGLE, OPT_GRAPHVIZ_ignorenode_EXTERNAL, OPT_GRAPHVIZ_ignorenode_NOREFERER, OPT_GOOGLEHUMANLANGUAGE, OPT_FILTERSPAM, OPT_MAXADSENSED, OPT_GREP, OPT_EXCLUDE, OPT_IGNORE404, OPT_DEBUG, OPT_SCREENINFO}; /* command line switches definition: * the rule with short options is to take upper case the * 'special' options (the option a normal user should not use) */ static struct ago_optlist visitors_optlist[] = { { 'A', "all", OPT_ALL, AGO_NOARG}, { 'T', "trails", OPT_TRAILS, AGO_NOARG}, { 'G', "google", OPT_GOOGLE, AGO_NOARG}, { 'K', "google-keyphrases", OPT_GOOGLEKEYPHRASES, AGO_NOARG}, { 'Z', "google-keyphrases-age", OPT_GOOGLEKEYPHRASESAGE, AGO_NOARG}, { 'H', "google-human-language", OPT_GOOGLEHUMANLANGUAGE, AGO_NOARG}, { 'U', "user-agents", OPT_USERAGENTS, AGO_NOARG}, { 'W', "weekday-hour-map", OPT_WEEKDAYHOUR_MAP, AGO_NOARG}, { 'M', "month-day-map", OPT_MONTHDAY_MAP, AGO_NOARG}, { 'R', "referers-age", OPT_REFERERSAGE, AGO_NOARG}, { 'D', "domains", OPT_TLD, AGO_NOARG}, { 'O', "operating-systems", OPT_OS, AGO_NOARG}, { 'B', "browsers", OPT_BROWSERS, AGO_NOARG}, { 'X', "error404", OPT_ERROR404, AGO_NOARG}, { 'Y', "pageviews", OPT_PAGEVIEWS, AGO_NOARG}, { 'S', "robots", OPT_ROBOTS, AGO_NOARG}, { '\0', "screen-info", OPT_SCREENINFO, AGO_NOARG}, { '\0', "stream", OPT_STREAM, AGO_NOARG}, { '\0', "update-every", OPT_UPDATEEVERY, AGO_NEEDARG}, { '\0', "reset-every", OPT_RESETEVERY, AGO_NEEDARG}, { 'f', "output-file", OPT_OUTPUTFILE, AGO_NEEDARG}, { 'm', "max-lines", OPT_MAXLINES, AGO_NEEDARG}, { 'r', "max-referers", OPT_MAXREFERERS, AGO_NEEDARG}, { 'p', "max-pages", OPT_MAXPAGES, AGO_NEEDARG}, { 'i', "max-images", OPT_MAXIMAGES, AGO_NEEDARG}, { 'x', "max-error404", OPT_MAXERROR404, AGO_NEEDARG}, { 'u', "max-useragents", OPT_MAXUSERAGENTS, AGO_NEEDARG}, { 't', "max-trails", OPT_MAXTRAILS, AGO_NEEDARG}, { 'g', "max-googled", OPT_MAXGOOGLED, AGO_NEEDARG}, { '\0', "max-adsensed", OPT_MAXADSENSED, AGO_NEEDARG}, { 'k', "max-google-keyphrases",OPT_MAXGOOGLEKEYPHRASES,AGO_NEEDARG}, { 'z', "max-google-keyphrases-age",OPT_MAXGOOGLEKEYPHRASESAGE, AGO_NEEDARG}, { 'a', "max-referers-age", OPT_MAXREFERERSAGE, AGO_NEEDARG}, { 'd', "max-domains", OPT_MAXTLD, AGO_NEEDARG}, { 's', "max-robots", OPT_MAXROBOTS, AGO_NEEDARG}, { '\0', "grep", OPT_GREP, AGO_NEEDARG}, { '\0', "exclude", OPT_EXCLUDE, AGO_NEEDARG}, { 'P', "prefix", OPT_PREFIX, AGO_NEEDARG}, { 'o', "output", OPT_OUTPUT, AGO_NEEDARG}, { 'V', "graphviz", OPT_GRAPHVIZ, AGO_NOARG}, { '\0', "graphviz-ignorenode-google", OPT_GRAPHVIZ_ignorenode_GOOGLE, AGO_NOARG}, { '\0', "graphviz-ignorenode-external", OPT_GRAPHVIZ_ignorenode_EXTERNAL, AGO_NOARG}, { '\0', "graphviz-ignorenode-noreferer", OPT_GRAPHVIZ_ignorenode_NOREFERER, AGO_NOARG}, { 'v', "version", OPT_VERSION, AGO_NOARG}, { '\0', "tail", OPT_TAIL, AGO_NOARG}, { '\0', "time-delta", OPT_TIMEDELTA, AGO_NEEDARG}, { '\0', "filter-spam", OPT_FILTERSPAM, AGO_NOARG}, { '\0', "ignore-404", OPT_IGNORE404, AGO_NOARG}, { '\0', "debug", OPT_DEBUG, AGO_NOARG}, { 'h', "help", OPT_HELP, AGO_NOARG}, AGO_LIST_TERM }; void visitors_show_help(void) { int i; printf("Usage: visitors [options] [ ...]\n"); printf("Available options:\n"); for (i = 0; visitors_optlist[i].ao_long != NULL; i++) { if (visitors_optlist[i].ao_short != '\0') { printf(" -%c ", visitors_optlist[i].ao_short); } else { printf(" "); } printf("--%-30s %s\n", visitors_optlist[i].ao_long, (visitors_optlist[i].ao_flags & AGO_NEEDARG) ? "" : ""); } printf("\nNOTE: --filter-spam can be *very* slow. Use with care.\n\n"); printf("For more information visit http://www.hping.org/visitors\n" "Visitors is Copyright(C) 2004-2006 Salvatore Sanfilippo \n"); } int main(int argc, char **argv) { int i, o; struct vih *vih; char *filenames[VI_FILENAMES_MAX]; int filenamec = 0; /* Handle command line options */ while((o = antigetopt(argc, argv, visitors_optlist)) != AGO_EOF) { switch(o) { case AGO_UNKNOWN: case AGO_REQARG: case AGO_AMBIG: ago_gnu_error("visitors", o); visitors_show_help(); exit(1); break; case OPT_HELP: visitors_show_help(); exit(0); break; case OPT_VERSION: printf("Visitors %s\n", VI_VERSION_STR); exit(0); case OPT_MAXREFERERS: Config_max_referers = atoi(ago_optarg); break; case OPT_MAXPAGES: Config_max_pages = atoi(ago_optarg); break; case OPT_MAXIMAGES: Config_max_images = atoi(ago_optarg); break; case OPT_MAXERROR404: Config_max_error404 = atoi(ago_optarg); break; case OPT_MAXUSERAGENTS: Config_max_agents = atoi(ago_optarg); break; case OPT_MAXTRAILS: Config_max_trails = atoi(ago_optarg); break; case OPT_MAXGOOGLED: Config_max_googled = atoi(ago_optarg); break; case OPT_MAXADSENSED: Config_max_adsensed = atoi(ago_optarg); break; case OPT_MAXGOOGLEKEYPHRASES: Config_max_google_keyphrases = atoi(ago_optarg); break; case OPT_MAXGOOGLEKEYPHRASESAGE: Config_max_google_keyphrases_age = atoi(ago_optarg); break; case OPT_MAXREFERERSAGE: Config_max_referers_age = atoi(ago_optarg); break; case OPT_MAXTLD: Config_max_tld = atoi(ago_optarg); break; case OPT_MAXROBOTS: Config_max_robots = atoi(ago_optarg); break; case OPT_USERAGENTS: Config_process_agents = 1; break; case OPT_GOOGLE: Config_process_google = 1; break; case OPT_GOOGLEKEYPHRASES: Config_process_google_keyphrases = 1; break; case OPT_GOOGLEKEYPHRASESAGE: Config_process_google_keyphrases_age = 1; break; case OPT_GOOGLEHUMANLANGUAGE: Config_process_google_keyphrases = 1; Config_process_google_human_language = 1; break; case OPT_TLD: Config_process_tld = 1; break; case OPT_OS: Config_process_os = 1; break; case OPT_BROWSERS: Config_process_browsers = 1; break; case OPT_ERROR404: Config_process_error404 = 1; break; case OPT_PAGEVIEWS: Config_process_pageviews = 1; break; case OPT_ROBOTS: Config_process_robots = 1; break; case OPT_ALL: Config_process_agents = 1; Config_process_google = 1; Config_process_google_keyphrases = 1; Config_process_google_keyphrases_age = 1; Config_process_google_human_language = 1; Config_process_weekdayhour_map = 1; Config_process_monthday_map = 1; Config_process_referers_age = 1; Config_process_tld = 1; Config_process_os = 1; Config_process_browsers = 1; Config_process_error404 = 1; Config_process_pageviews = 1; Config_process_robots = 1; Config_process_screen_info = 1; break; case OPT_PREFIX: if (Config_prefix_num < VI_PREFIXES_MAX) { Config_prefix[Config_prefix_num].str = ago_optarg; Config_prefix[Config_prefix_num].len = strlen(ago_optarg); Config_prefix_num++; } else { fprintf(stderr, "Error: too many prefixes specified\n"); exit(1); } break; case OPT_TRAILS: Config_process_web_trails = 1; break; case OPT_MAXLINES: { int aux = atoi(ago_optarg); Config_max_referers = aux; Config_max_pages = aux; Config_max_images = aux; Config_max_error404 = aux; Config_max_agents = aux; Config_max_googled = aux; Config_max_adsensed = aux; Config_max_trails = aux; Config_max_google_keyphrases = aux; Config_max_google_keyphrases_age = aux; Config_max_referers_age = aux; Config_max_tld = aux; Config_max_robots = aux; } break; case OPT_OUTPUT: if (!strcasecmp(ago_optarg, "text")) Output = &OutputModuleText; else if (!strcasecmp(ago_optarg, "html")) Output = &OutputModuleHtml; else { fprintf(stderr, "Unknown output module '%s'\n", ago_optarg); exit(1); } break; case OPT_GRAPHVIZ: Config_graphviz_mode = 1; Config_process_web_trails = 1; break; case OPT_GRAPHVIZ_ignorenode_GOOGLE: Config_graphviz_ignorenode_google = 1; break; case OPT_GRAPHVIZ_ignorenode_EXTERNAL: Config_graphviz_ignorenode_external= 1; break; case OPT_GRAPHVIZ_ignorenode_NOREFERER: Config_graphviz_ignorenode_noreferer = 1; break; case OPT_TAIL: Config_tail_mode = 1; break; case OPT_WEEKDAYHOUR_MAP: Config_process_weekdayhour_map = 1; break; case OPT_MONTHDAY_MAP: Config_process_monthday_map = 1; break; case OPT_REFERERSAGE: Config_process_referers_age = 1; break; case OPT_STREAM: Config_stream_mode = 1; break; case OPT_OUTPUTFILE: Config_output_file = ago_optarg; break; case OPT_UPDATEEVERY: Config_update_every = atoi(ago_optarg); break; case OPT_RESETEVERY: Config_reset_every = atoi(ago_optarg); break; case OPT_TIMEDELTA: Config_time_delta = atoi(ago_optarg); break; case OPT_FILTERSPAM: Config_filter_spam = 1; break; case OPT_GREP: ConfigAddGrepPattern(ago_optarg, VI_PATTERNTYPE_GREP); break; case OPT_EXCLUDE: ConfigAddGrepPattern(ago_optarg, VI_PATTERNTYPE_EXCLUDE); break; case OPT_IGNORE404: Config_ignore_404 = 1; break; case OPT_DEBUG: Config_debug = 1; break; case OPT_SCREENINFO: Config_process_screen_info = 1; break; case AGO_ALONE: if (filenamec < VI_FILENAMES_MAX) filenames[filenamec++] = ago_optarg; break; } } /* If the user specified the 'tail' mode, we * just emulate a "tail -f" for the specified files. */ if (Config_tail_mode) { vi_tail(filenamec, filenames); return 0; } /* Check if at least one file was specified */ if (filenamec == 0 && !Config_stream_mode) { fprintf(stderr, "No logfile specified\n"); visitors_show_help(); exit(1); } /* If the prefix was not set, but the user asks for * web trails, notify it and exit. */ if (Config_process_web_trails && !Config_prefix_num) { fprintf(stderr, "At least one prefix must be specified (using --prefix) for web trails\nExample: --prefix http://your.site.org\n"); exit(1); } /* If screen-info is enabled, error 404 must be too, auto-enable it. */ if (Config_process_screen_info && !Config_process_error404) { fprintf(stderr, "Note: 404 error processing enabled for screen-info report\n"); Config_process_error404 = 1; } /* If stream-mode is enabled, --output-file should be specified. */ if (Config_stream_mode && Config_output_file == NULL) { fprintf(stderr, "--stream requires --output-file\n"); exit(1); } /* Set the default output module */ if (Output == NULL) Output = &OutputModuleHtml; /* Change to "C" locale for date/time related functions */ setlocale(LC_ALL, "C"); /* Process all the log files specified. */ vih = vi_new(); for (i = 0; i < filenamec; i++) { if (vi_scan(vih, filenames[i])) { fprintf(stderr, "%s: %s\n", filenames[i], vi_get_error(vih)); exit(1); } } if (Config_graphviz_mode) { vi_print_graphviz(vih); } else { if (vi_print_report(Config_output_file, vih)) { fprintf(stderr, "%s\n", vi_get_error(vih)); exit(1); } if (Config_stream_mode) { vi_stream_mode(vih); } } vi_print_statistics(vih); /* The following is commented in releases as to free the hashtable * memory is very slow, it's better to just exit the program. * Still it is important to be able to re-enable a good cleanup * in order to run visitors against valgrind to check for memory * leaks. */ /* vi_free(vih); */ return 0; } visitors_0.7/visitors.css0100644000175000017500000000121210412774745015642 0ustar antirezantirezH2 { font-family: Verdana, Arial; font-size: 14px; font-weight: bold; } DD { font-family: Verdana, Arial; font-size: 12px; } A { font-family: Verdana, Arial; font-size: 12px; } .maintitle { font-family: Verdana, Arial; font-size: 16px; font-weight: bold; } .title { font-family: Verdana, Arial; font-size: 14px; font-weight: bold; } .text { font-family: Verdana, Arial; font-size: 12px; margin-left: 5px; } .code { font-family: monospace; font-weight: bold; color: darkgreen; font-size: 12px; margin-left: 9px; } LI { font-family: Verdana, Arial; font-size: 12px; margin-left: 5px; } visitors_0.7/visitors.png0100644000175000017500000001341010412774745015641 0ustar antirezantirezPNG  IHDR/FbKGD pHYs  tIMEi'tEXtCommentCreated with The GIMPd%nlIDATxytyHby,yo` %jsHZz~'' -?NzI#t9mhNBHpZ^ زe[k$;۽Y7,3}߹sywe-7AYe*LyYe)/2eUʔU%%m[i63Bsiz^%@$=MEEE\r)HK]gx,6;OHȊYb.8TeRt Ë- 5Z;:Rv{˭>ߝݿ==Q-K.^02x<@@eI6c ۶mYT*lkK 30>:sn7(sAlÇkstp fZ --\2 ,OY @9dcuK G++onX*_2񑟾s=wxgPdIԴp~x7W74(n7K0! `e0&،QIEQI(-QǏ?7'{*[7r?-wDD#}/_N6/ZݝM&eiچ&@6ыE43$Ɇ#I |>! De.r#_0hXVo{;U~;2\GL⌢ʔҶÇ=w#H$IxުHjJMdY$ilRB$IPJ!s.IajYeY,BLuݶm˲ ðms^(tY1.RUU ʚ3j$6J˩2S s0ةήS۷e˯Gҁ@|>+I!snF.G5UDB8 !L@@P* !sg$˔MIƺJ(.g1M1z:L*HP[Z箼nu7Z/˔Oe#NܳCO % T*aE0 C7M˲,۶EeYUUg$8C"BNv4&ˊ,)B)IR&u=i&1[p!PUsi|~VE$JaBAA*h<^ڵ]ڊjYq;wSn}{wkGi'Y WUbCl!R!I,~.Gh4 x-)Jx<^( C,sz~_0|~hhhxxUV%VR*)2 ?푶.ʲ222:22bQH]}ݜٳ"F.\ii$B=%GFF2 M JlxV!)Ebx͛7tHu60!UUU$=z5oHz q׿fr\&,KQPuŊVjll|}{T_~`;\kzzzvmƒ%K.]dsǎ{9sfOOOcC ?T).Ovw9's].WSsmv--@8Bw6Blۖ$ɶm'4MSQƘ04Msvܛp IDQKD ei Hf B>˧{byFRUe?:~_}>`ذaC(׾d{qĉ߿әlPpߓ\׫hiQO `P 4gW|^S|>n)4'NebÜ !R,+ S>b%MXz6 )x{{eB۶m/yT*^\G"1Z(Bjݒ#ݒ%{<Ћ{i ILV<ƣʅ3fb !NJq^/oYs_$.`ߺ;n?t'?IUUeY]]]GijjZxTѣ |?"q:={/T~TR @ Hiy/ d,pY+rTU%sˮeWvPJnݺy/رߚtOp*t. _y_#CC7n\vmgg>niڵ_uYϛvl&(\9! YDUʍprB J"˪,!d.T}d}oع󝎎.{+jriIy>G4ͻt˗Y& |>۶A2*Ә +R8s@BnY4 SQIBsǫq}v{9 T K޿aB4!ceeY*.Wy}t ;*mێ;5-----͵Q1+NRBΊ(I&|B$x<.r(2MӲ,YEq\.K4B)94$ O~\v13?e['өvI̱aP*.-KdP4f1 z ie2i˶aEQq0t6B%UE4Mܥ)H5H-HHHPOaQ΁"D"1@'z5n۶aX^s!JO'hd !,+cnw)v,Ka Wz^DLpfl6Ȳ$* *ɲB)eYNvjz(pd:Pn@d  D" St7,Ƙ9͸iiRJ"Q P |،9a')#Tr2OȲL)$Y(e. Zi 11  ed'˭?~,x 13J7\$ 8Ql=H p)ŋaat7$~7˚3ul]O;8FLxWdomy0gC5y?k qz _[hژ ? =2?龸g7?0H""/Cg;6eg+^pcOs.D٢d 5} / S\Yi3ٿҮ`ͮ5 }(X*G&@uq j,5Wj H%u ׏zwt,9Ż~'fL˜_$ nJͩvuFő [}ن 9y:)=~Jɦ:Ĵ/?gBGdiqn傳g^Ʋf5+S>%`A$ !  FgȢ)Qd Rg4:n^T~5 w^^ctx1ooȹ mwhR^gO ,aU8kr_ӹKC~;{\섌 0H}@(@:D5A x?ٙOZ4x }}P[o4FR>H|[v$}dT_e5+^;n* G?sHJ!?Rm$K|rY 111~_]}qV<#WW4S3K:W>0.lZ_R5-~v&'tA=b?,ɛc^~􋑉6أvZ؋\P-D6kv^j:CkUyz^:S߾~6~4 ]!b1xɷqޏ"^ºH@jqϝ_Kou]ߨQȝNk5|{"Y=_>ѧx):>ws#?<~nߜu}lh'? 5f8`L״Wm0 󪃧܎[Ry}E% d!B$)})/:iyQINxnlVOtNQ׷_HFԒbB~{Fv뎩Z:/}pOݟN8o ewOH5Ɏbҗ@$@[W7\5~?uhI;4|t+`l:7=΂:P{NJWu_dۊnJkG|{\g;{jmzs_4mUgPZx߉HJvgL~]l=;YZN|k˹/A!@P1Hs_4ߥ<؆ |7C؜m1BoCp:^C:/=|\A<6u~=/IU}f v+rUʥ U!If{ɤJ,˵w|y`0D ;!XxW=GҮ/9`MܨB@čr MZPl(X&ÃZ( B0\ϩJ]E<0`E̩V.0ƻv4-H# vfLD,ɗ4| a8ai á4E,M֝+/~ZUd}c"xZKUR??'cbCQPG&Q @b" V&Gޘ.v%7-cKidG)D\@" rh&!bPasaK?( 5 u u (74~IENDB`