A shiny app to explore nginx access logs and geolocate the connections
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

54 lines
1.5KB

  1. library(tidyverse)
  2. library(RSQLite)
  3. library(ipapi)
  4. library(leaflet)
  5. # sqlite3 access.db
  6. # create table access(ip, null1, user, timestamp, zone, req, status, size, referer, agent, null2);
  7. # .separator " "
  8. # .import access.log access
  9. dbConnect(SQLite(), "access.db") %>%
  10. dbGetQuery("delete from access where ip = '192.168.0.254' or user = 'maxx' or agent like '%bot%' or ip = '164.2.255.244';")
  11. dbConnect(SQLite(), "access.db") %>%
  12. dbGetQuery("vacuum;")
  13. known_ips <- character(0)
  14. src_sqlite("access.db") %>%
  15. tbl("geoip") %>%
  16. select(query) %>%
  17. collect %>%
  18. pull(query) -> known_ips
  19. src_sqlite("access.db") %>%
  20. tbl("access") %>%
  21. select(ip) %>%
  22. collect %>%
  23. pull(ip) %>%
  24. unique %>%
  25. setdiff(known_ips) -> ips
  26. if (length(ips) > 0)
  27. {
  28. ips %>%
  29. geolocate -> geoip
  30. dbConnect(SQLite(), "access.db") %>%
  31. dbWriteTable("geoip", geoip, append = T)
  32. }
  33. src_sqlite("access.db") %>%
  34. tbl("access") %>%
  35. collect %>%
  36. left_join(geoip, by = c("ip" = "query")) %>%
  37. select(-null1, -user, -zone, -size, -null2, -as, -countryCode, -org, -region, -regionName, -status.y, -timezone, -zip, -isp) %>%
  38. mutate(timestamp = timestamp %>% str_sub(2) %>% as.POSIXct(format = "%d/%b/%Y:%H:%M:%S"),
  39. req = req %>% str_replace("(HEAD|GET|POST) ", ""),
  40. req = req %>% str_replace("/(.*?/).*", "\\1")) -> geoaccess
  41. leaflet(data = geoaccess) %>%
  42. addProviderTiles(providers$CartoDB.Positron) %>%
  43. addMarkers(~lon, ~lat, clusterOptions = markerClusterOptions())