ユーザーアクティビティのログファイル解析

import re from collections import defaultdict def analyze_logs(log_data): """ マルチラインのログ文字列を解析し、以下のサマリー辞書を返します。 - counts_by_level: 大文字のログレベルごとのログエントリ数 - successful_logins: 正常にログインした一意のユーザー名 - failed_login_ips: IPアドレスごとのログイン失敗試行回数 不正な形式または関連性のない行は無視されます。 """ counts_by_level = defaultdict(int) successful_logins = set() failed_login_ips = defaultdict(int) # 次のような行に一致します: [TIMESTAMP] LEVEL: MESSAGE log_line_pattern = re.compile( r"^\ между(?P<timestamp>[^\]]+)\]\s+(?P<level>[A-Za-z]+)\s*:\s*(?P<message>.*)$" ) # ログイン成功例: User 'alice' logged in from IP '192.168.1.10' success_pattern = re.compile( r"User\s+'([^']+)'\s+logged\s+in\b", re.IGNORECASE, ) # ログイン失敗例: Failed login attempt for user 'bob' from IP '203.0.113.5' failed_pattern = re.compile( r"Failed\s+login\s+attempt\s+for\s+user\s+'[^']+'\s+from\s+IP\s+'([^']+)'", re.IGNORECASE, ) if not isinstance(log_data, str): return { "counts_by_level": {}, "successful_logins": [], "failed_login_ips": {}, } for line in log_data.splitlines(): line = line.strip() if not line: continue match = log_line_pattern.match(line) if not match: continue level = match.group("level").upper() message = match.group("message") counts_by_level[level] += 1 success_match = success_pattern.search(message) if success_match: successful_logins.add(success_match.group(1)) failed_match = failed_pattern.search(message) if failed_match: failed_login_ips[failed_match.group(1)] += 1 return { "counts_by_level": dict(counts_by_level), "successful_logins": sorted(successful_logins), "failed_login_ips": dict(failed_login_ips), } # 使用例: if __name__ == "__main__": sample_logs = """ [2023-10-27T10:00:00Z] INFO: Server starting up. [2023-10-27T10:01:00Z] INFO: User 'alice' logged in from IP '192.168.1.10' [2023-10-27T10:02:30Z] WARN: Failed login attempt for user 'bob' from IP '203.0.113.5' This is not a valid log line and should be ignored. [2023-10-27T10:03:00Z] error: Database connection failed. [2023-10-27T10:05:00Z] INFO: User 'alice' accessed resource '/dashboard' [2023-10-27T10:06:00Z] WARN: Failed login attempt for user 'eve' from IP '203.0.113.5' [2023-10-27T10:07:00Z] INFO: User 'charlie' logged in from IP '198.51.100.2'""" print(analyze_logs(sample_logs))

import re def analyze_logs(log_data): """ ログデータを分析し、要約辞書を返します。 Args: log_data: 各行が [TIMESTAMP] LEVEL: MESSAGE の形式のログエントリである複数行の文字列 Returns: キーを持つ辞書: - counts_by_level: ログレベルごとのカウント辞書 - successful_logins: ログインした一意のユーザー名のリスト - failed_login_ips: IPアドレスとログイン失敗回数の辞書 """ counts_by_level = {} successful_logins = set() failed_login_ips = {} lines = log_data.split('\n') for line in lines: line = line.strip() if not line: continue # ログ行の形式を解析: [TIMESTAMP] LEVEL: MESSAGE match = re.match(r'^\\[.*?\\]\\s+(\\w+):\\s*(.*)$', line) if not match: continue level = match.group(1).upper() message = match.group(2) # レベルごとのカウント counts_by_level[level] = counts_by_level.get(level, 0) + 1 # ログイン成功を確認: "User 'username' logged in..." login_match = re.search(r"User\\s+'([^']+)'\\s+logged in", message) if login_match: username = login_match.group(1) successful_logins.add(username) # ログイン失敗を確認: "Failed login attempt for user 'username' from IP 'ip_address'" failed_match = re.search(r"Failed login attempt for user\\s+'[^']+'\\s+from IP\\s+'([^']+)'", message) if failed_match: ip = failed_match.group(1) failed_login_ips[ip] = failed_login_ips.get(ip, 0) + 1 return { 'counts_by_level': counts_by_level, 'successful_logins': list(successful_logins), 'failed_login_ips': failed_login_ips }