Parse pf.log and count traffic. Gray IP's

# http://scratch-tales.blogspot.ru/
#!/usr/local/bin/python2.7

import datetime
import time
import MySQLdb
import subprocess
import os
import shutil

def trafic_count(log_name, trafic_type):
#--------------F_VAR-----------------------
    trafic_sum = 0
    i = 0
    bytes_count = []
    ip_split = []
    ip_list = []
    ip_cnt = []
    bytes_cut = ''
    ip_cut = ''
    ip_tmp = ''

#----------set separator char and insert type----------------------
    if trafic_type == 'in':
        char_separator = ':'
        insert_type = """INSERT INTO net_local_traffic_in_volume (ip, traffic_volume, measuring_date) VALUES (%s, %s, %s)"""
    elif trafic_type == 'out':
        char_separator = ' '
        insert_type = """INSERT INTO net_local_traffic_out_volume (ip, traffic_volume, measuring_date) VALUES (%s, %s, %s)"""

    f = open(log_name, 'r')
    trafic_read = f.xreadlines()

#-------------------parsing log--------------------------------------

    for get_string in trafic_read:
        len_pos = get_string.rfind(' len ')
        ip_pos = get_string.find('192.168.1.')

        if len_pos != -1:
            bytes_cut = get_string[len_pos + 4:]
            coma_pos = bytes_cut.find(',')
            if coma_pos != -1:
                trafic_sum = trafic_sum + int(bytes_cut[0:coma_pos])
            elif coma_pos == -1:
                coma_pos = bytes_cut.find(')')
                if coma_pos != -1:
                    trafic_sum = trafic_sum + int(bytes_cut[0:coma_pos])

        if ip_pos != -1:
            ip_tmp = get_string[ip_pos:]
            dot_pos = ip_tmp.find(char_separator)
            ip_cut = ip_tmp[0:dot_pos]
            ip_split = ip_cut.split('.')
            ip_clear = ".".join(ip_split[0:4])
            ip_count = ip_list.count(ip_clear)

            if ip_count == 0:
                ip_cnt.append(i)
                i = i + 1
                ip_list.append(ip_clear)
                bytes_count.append(bytes_cut[0:coma_pos])

            if ip_count != 0:
                ip_pos = ip_list.index(ip_clear)
                bytes_tmp = float(bytes_count[ip_pos])
                bytes_count[ip_pos] = bytes_tmp + float(bytes_cut[0:coma_pos])

#------------------connect and insert in db-----------------------

    tempura_connect = MySQLdb.connect(host='127.0.0.1', port=3310, user='tempdbuser', passwd='tempdbuser', db='tempuradb')
    tempura_query = tempura_connect.cursor()

    for i in range(len(ip_list)):
        tempura_query.execute(insert_type ,(ip_list[i], bytes_count[i], (datetime.datetime.now() - datetime.timedelta(days=1)).strftime("%d-%m-%Y")))
        tempura_connect.commit()

    f.close()
    tempura_query.close()
    tempura_connect.close()
#--------------------------------end of traffic count func---------------------------


#----------------------------------------BODY----------------------------------------
#-------------------------------gunzip and tcpdumping yesterday pf.log---------------

if os.path.exists('/var/log/pflog.0.gz') == True:
    rm_result = subprocess.Popen('rm /usr/local/scripts/tmp/*', shell=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
    ret = rm_result.wait()

    ret = shutil.copy('/var/log/pflog.0.gz', '/usr/local/scripts/tmp/pflog.0.gz')

    gunzip_log = subprocess.Popen('gunzip /usr/local/scripts/tmp/pflog.0.gz -o /usr/local/scripts/tmp/pflog', shell=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
    ret = gunzip_log.wait()

    tcpdump_log_in = subprocess.Popen("tcpdump -n -t -v -r /usr/local/scripts/tmp/pflog 'dst net 192.168.1.0 mask 255.255.255.0 and not (src net 192.168.1.0 mask 255.255.255.0)' > /usr/local/scripts/tmp/trafic_in.log" , shell=True, stdout=subprocess.PIPE,
stderr=subprocess.STDOUT)
    ret = tcpdump_log_in.wait()

    tcpdump_log_out = subprocess.Popen("tcpdump -n -t -v -r /usr/local/scripts/tmp/pflog 'src net 192.168.1.0 mask 255.255.255.0 and not (dst net 192.168.1.0 mask 255.255.255.0)' > /usr/local/scripts/tmp/trafic_out.log" ,shell=True, stdout=subprocess.PIPE,
stderr=subprocess.STDOUT)
    ret = tcpdump_log_out.wait()

#-----------------------parsing tcpdumping and count traff-----------------------------
trafic_count('/usr/local/scripts/tmp/trafic_out.log', 'out')
trafic_count('/usr/local/scripts/tmp/trafic_in.log', 'in')