IsaLogParseMain.cpp

/****************************************************
** ISA Log Parser                                  **
** Coded by: Dakota Vincent                        **
** This program takes the log files of the         **
** Enterasys hi-Path Wireless controllers, and the **
** Microsoft ISA Logs and parses them to determine **
** if there was any violations of approved sites   **
** and if so tells us who based on login and IP.   **
****************************************************/

#include <stdio.h>  //Lots of includes
#include <iostream>
#include <fstream>
#include <string>
#include <sstream>
#include <algorithm>
#include <iomanip>

using namespace std;

const char DELM=','; //delimiter in most cases a ','

void isaParse();
void hipathParse();
int reportStudents(string ipaddress);
/*
The array fields are
0 Event Id
1 Event Type (1 is Reg, 2 is Login, 3 is DeReg)
2 IP
3 MAC
4 Register Time
5 De-Register Time
6 Login Time
7 Username
*/
string eventArry[3500][8][30];     // The HiPath event arry, contains all the wireless events.

int results[3500];                 // Array to hold the results of the StudentReport function
string badwordarray[2000][20];     // Array of our Bad Words
int sizeofbadword[1000];           // How many letters in each bad word

int main() {

    system("isa2logbackup.bat"); // Run batch file to create our generic files to process

    hipathParse(); // This function parses the HiPath Syslog

    isaParse();    // This funcetion parses the ISA 2 log

    //system("pause");

    return 0;
}

void isaParse()
{
    //ISA Parsing function

    string line,specificline,linewrite,foundterm,ipaddr,compare1,compare2;  // String to hold stuff from ISA log
    istringstream convert;

    ifstream myfile;
    myfile.open("ISA2LOG.TXT"); // Open our input files.
    ifstream badwords;
    badwords.open("badwords.txt");

    ofstream outscan;
    outscan.open("ISA2LOGPARSED.TXT"); // Open output file
    outscan.clear();

    size_t found;                // Special varible to hold the location of our bad word when we search

    bool busted=false;           // Bool to decide if there was a bad word

    int badwordcount=0; // Count how many bad words
    int count,count2,length1;
    int studentcounter = 0;   // generic counters

    while(badwords.good())
    {
        getline(badwords,badwordarray[badwordcount][0]);                      // Read in our Bad Words to an 2 dimensional array, first dimension is the word second is the letters in the word
        sizeofbadword[badwordcount]=badwordarray[badwordcount][0].size();     // Get the amount of characters in one bad word
        badwordcount++;                                                       // Add one so we can get the size of each bad word
    }


    while(myfile.good())             // Read in from our ISA log
    {
        busted=false;
        getline(myfile,line);        // Read in one line from our log

        istringstream demline;       // Getline can only read streams
        demline.str(line);           // so we will make a string a stream

        linewrite="";                // Clear out this variable, just to make sure

        for(int i=0;i<30;i++)
        {
            getline(demline,specificline,DELM);  // Using our stream we just made parse it based on the delimiter.

            if(i==0||i==9||i==18||i==28||i==29) // Get the information we want, based on CSV positions. Print it to a file
            {
                if(i!=29)                       // Make sure that the Date shows up first and not last
                {
                linewrite += specificline;
                }
                if(i==18)                      // Test if there was a bad word in the URL
                {
                    count=0;

                    while(count<badwordcount)
                    {
                        foundterm="";
                        count2=0;

                        while(count2<sizeofbadword[count])
                        {
                            foundterm+=badwordarray[count][count2];       // Building up our search term since a string array is a character array
                            count2++;
                        }

                        found = string::npos;                            // Make sure that found is set to not found
                        found = specificline.find(foundterm);            // Our actual search statement

                        if (found!=string::npos)                         // If it is found print out what word, and set busted to true
                        {
                            outscan<<foundterm<<": ";
                            busted=true;
                        }

                        count++;
                    }
                }
                if(i==0)
                {
                    ipaddr=specificline;
                }
            }
        }
        if(busted)                                        // Check and see if they was busted or not, then write the info to a file, and set busted to false
        {
            outscan<<specificline<<" "<<linewrite<<endl;
            studentcounter = reportStudents(ipaddr);              //Run the reportStudent function to initilize our results array
            for(int counter=1;counter<=studentcounter;counter++)
            {
                count=results[counter]-1;                         // Match the results array to our event array
                if(count!=0)
                {
                    for(int counter3=0;counter3<8;counter3++)
                    {
                        outscan<<"   ";
                        length1=eventArry[count][counter3][0].size();
                        for(int iai=0;iai<length1;iai++)
                        {
                        outscan<<eventArry[count][counter3][iai];      // Build up out output statement to report the offenders
                        }
                    }
                }   outscan<<endl;
                outscan<<endl;
            }

            busted=false;
        }
    }
    outscan.close();   // Close our files.
    myfile.close();
    badwords.close();
}
void hipathParse()
{
    string temp,line,specificline,linewrite,linewrite2,foundterm[5][35];
    string holder,date,macaddr,ipaddr,username;  // String to hold stuff from our log

    ifstream hipathlog;                       // Open our Input files
    hipathlog.open("hipathlog.txt");

    ofstream hipathoutput;                     // Open our output files
    hipathoutput.open("hipathparsed.txt");

    int count,count2;    // Generic Counters
    int eventid = 0;
    int wordcount;

    bool busted;

    size_t found,grab,finish;                // Special varible to hold the location of our search term

    string temp1,temp2;
    istringstream findin,findin2,findin3,findin4,findin5,findin6;   // String Streams to search for the Hipath events

    temp1="cumberland_guest";     // Make sure it is from guest wireless
    findin.str(temp1);
    getline(findin,temp2);
    foundterm[0][0]=temp2;

    temp1="Cumberland Guest";   // Same as before just for other types of statements
    findin2.str(temp1);
    getline(findin2,temp2);
    foundterm[1][0]=temp2;

    temp1="Client session state changed ( IP[";   // Look for a registration event
    findin3.str(temp1);
    getline(findin3,temp2);
    foundterm[2][0]=temp2;

    temp1="successfully authenticated";  // Look for a login event
    findin4.str(temp1);
    getline(findin4,temp2);
    foundterm[3][0]=temp2;

    temp1="de-registration succeeded";  // Look for a deregister event
    findin5.str(temp1);
    getline(findin5,temp2);
    foundterm[4][0]=temp2;
    wordcount=0;

    while(hipathlog.good()) // While we can read from the file
    {

        wordcount++;
        getline(hipathlog,line);
        temp="";
        for(int i=0;i<35;i++)
        {
            temp+=foundterm[0][i];
        }
        found = string::npos;
        found = line.find(temp);

        busted = false;
        if (found!=string::npos)
        {
            busted=true;
            goto bust;
        }

        temp="";
        for(int i=0;i<35;i++)
        {
            temp+=foundterm[1][i];
        }

        found = string::npos;
        found = line.find(temp);
        if (found!=string::npos)
        {
            busted = true;
            goto bust;
        }

        bust:
        if(busted)
        {
            istringstream demline;       // Getline can only read streams
            demline.str(line);           // so we will make a string a stream

            for(int a=0;a<5;a++)
            {
                getline(demline,specificline,DELM);  // Using our stream we just made parse it based on the delimiter.



                if(a==0||a==4) // Get the information we want, based on CSV positions. Print it to a file
                {
                    if(a==0)
                    {
                        date = specificline;
                    }

                    if(a==4)
                    {
                        count = 2;
                            while(count<5)
                            {

                                temp="";
                                for(int i=0;i<35;i++)
                                {
                                    temp+=foundterm[count][i];
                                }

                                found = string::npos;                            // Make sure that found is set to not found
                                found = specificline.find(temp);  // Our actual search statement

                                if (found!=string::npos)
                                {
                                    switch(count)    // This switch statement decides what type of event was found in the HiPath Log
                                    {                // It then places it in the EventArry with the useful information
                                    case 2:
                                        {
                                            istringstream grabber;        // Create a string stream to hold the string to manipulate it into sub strings
                                            grabber.str(specificline);

                                            found = string::npos;
                                            found = specificline.find(']');   // Find the end of the IP Address

                                            grab = 59;           // 59 characters in is where the IP Address starts
                                            grabber.seekg(grab);

                                            size_t poscount;
                                            poscount=59;

                                            linewrite="";    // Clear out our temp varibles
                                            macaddr="";
                                            ipaddr="";

                                            while(poscount<=found)      // While the starting locatiopn is less than the location of the last ]
                                            {
                                                ipaddr+=grabber.get();           // Build up the varible one character at a time
                                                poscount++;
                                            }

                                            linewrite+=ipaddr;        // Build up the variables to output to a file
                                            linewrite+=" to";
                                            grabber.seekg(found+1);

                                            count2=0;

                                            while(count2<23)
                                            {
                                                macaddr+=grabber.get();   // Store the MAC address, same way as the IP address
                                                count2++;
                                            }


                                            linewrite+=macaddr;

                                            hipathoutput<<date<<" Assigned "<<linewrite<<endl;

                                            temp="";                           // This is our File output statement
                                            std::stringstream out;
                                            out<<eventid;
                                            temp=out.str();

                                            eventArry[eventid][0][0] = temp;   // This is where we create what goes in the eventArry
                                            eventArry[eventid][1][0] = "1";
                                            eventArry[eventid][2][0] = ipaddr;
                                            eventArry[eventid][3][0] = macaddr;
                                            eventArry[eventid][4][0] = date;

                                            eventid++;

                                            break;
                                        }

                                        case 3:
                                        {
                                            linewrite="";                // Clear out these variables, just to make sure
                                            macaddr="";
                                            username="";

                                            istringstream grabber;      // Build up our search line
                                            grabber.str(specificline);

                                            found = string::npos;               // Find the end of the MAC Address
                                            found = specificline.find(']');

                                            grab = 41;                  // Macs start 41 characters into the line
                                            grabber.seekg(grab);

                                            size_t poscount;
                                            poscount=41;

                                            while(poscount<=found)
                                            {
                                                linewrite+=grabber.get();   // While poscount is less than were we found the end of the MAC, build up the MAC Address
                                                poscount++ ;
                                            }

                                            macaddr = linewrite;  // Store our temp varible, and build up or string that goes to the file

                                            linewrite+=" to ";
                                            grabber.seekg(found);

                                            found = string::npos;
                                            finish = string::npos;

                                            found = specificline.find("username");    // Search for the user that logged in
                                            finish = specificline.find("has");
                                            finish = finish-1;

                                            grabber.seekg(found);
                                            poscount=found;

                                            while(poscount<=finish)          // Build up our username
                                            {
                                                username+=grabber.get();
                                                poscount++;
                                            }

                                            linewrite+=username;
                                            hipathoutput<<date<<" Authenticated "<<linewrite<<endl;   // More file output

                                            temp="";                      // Write out to our file
                                            std::stringstream out;
                                            out<<eventid;
                                            temp=out.str();

                                            eventArry[eventid][0][0] = temp;  // Save our info to the EventArry
                                            eventArry[eventid][1][0] = "2";
                                            eventArry[eventid][3][0] = macaddr;
                                            eventArry[eventid][6][0] = date;
                                            eventArry[eventid][7][0] = username;

                                            eventid++;
                                            break;
                                        }

                                        case 4:
                                        {
                                            linewrite="";                // Clear out these variables, just to make sure
                                            macaddr="";
                                            macaddr+="MAC";

                                            istringstream grabber;       // Build up our search line
                                            grabber.str(specificline);

                                            found = string::npos;
                                            finish = string::npos;
                                            finish = specificline.find(']');       // Find the location of the mac address
                                            found = specificline.find('[');
                                            grabber.seekg(found);
                                            while(found<=finish)      // Build up our MAC Address variable
                                            {
                                                macaddr+=grabber.get();
                                                found++;
                                            }
                                            linewrite += macaddr;                           // Build up our file output line
                                            linewrite+=" deregistered successfully.";

                                            hipathoutput<<date<<" MAC "<<linewrite<<endl;

                                            temp="";                       // Output to a file
                                            std::stringstream out;
                                            out<<eventid;
                                            temp=out.str();

                                            eventArry[eventid][0][0] = temp;  // Save everything in our EventArry
                                            eventArry[eventid][1][0] = "3";
                                            eventArry[eventid][3][0] = macaddr;
                                            eventArry[eventid][5][0] = date;

                                            eventid++;

                                            break;
                                        }
                                    }
                                }
                            count++;
                        }
                    }
                }
            }
        }
    }
    hipathoutput.close();  // Close our files
    hipathlog.close();
}
int reportStudents(string ipaddress)
{
    int a=0,b=0,holder=0;                                    // Create and initilize some varibles for processing Hipath and ISA
    string line,line2,compare1,compare2,macaddr,eventId;
    size_t found,length1,length2;
    macaddr="";

    for(int i=0;i<3500;i++)
    {
        results[a]=0;  // Initilize the result as zero, this is checked in ISA and counts as no results

        found = string::npos;      // Search for a Registration event
        line = eventArry[i][1][0];
        found = line.find("1");

        if(found!=string::npos)
        {
            found = string::npos;
            line = eventArry[i][2][0];
            found = line.find(ipaddress);  // Search for the IP Address passed by the ISA Function

            if(found!=string::npos)
            {
                length1=line.size();
                length2=int(ipaddress.size())+4;  // Check to see if the lengths match, because to the find function 192.168.1.1 will hit in 192.168.1.123

                if(length1==length2)
                {
                    macaddr="";

                    for(int iai=0;iai<eventArry[i][3][0].size();iai++)    // Build up the MAC Address character by character
                    {
                        macaddr+=eventArry[i][3][iai];
                    }

                    macaddr=macaddr.substr(5,17);    // Take only the MAC Address part no [,],etc.
                    results[a] = i+1;
                    a++;
                    b++;
                }
            }
        }




        //Login Section
        line="";
        found = string::npos;
        line = eventArry[i][1][0];
        found = line.find("2"); // Two is a login event
        if(found!=string::npos)
        {
            line="";
            found = string::npos;
            line = eventArry[i][3][0];
            found = line.find(macaddr); // Find if the MAC Address is the one we found registered eariler above.
            length1=macaddr.size(); // the Find function will always hit if you use a null string for search so make sure its not empty
            if(length1!=0)
            {
                if(found!=string::npos)
                {
                    results[a] = i+1;  // Write to the results array
                    a++;
                    b++;

                }
            }
        }
    }
    return b;
}