Parse NPS logs

use strict;

my @files = sort glob("//$ARGV[0]/c\$/windows/system32/logfiles/in*.log");

my $file = pop @files;

print STDERR "Using file $file\n";

open FILE, "$file" or die "$file: $!\n";

seek FILE, -2000000, 2;                     # seek to the a bit before the end
<FILE>;                                     # read the partial line

print "<table border=1>\n";
print "<TH>ComputerName<TH>ServiceName<TH>Record-Date<TH>Record-Time<TH>Packet-Type";
print "<TH>User-Name";
print "<th>Fully-Qualified-User-Name";
print "<TH>Called-Station-ID<TH>Calling-Station-ID";
print "<TH>Callback-Number<TH>Framed-IP-Address<TH>NAS-Identifier<TH>NAS-IP-Address<TH>NAS-Port";
print "<TH>Client-Vendor<TH>Client-IP-Address<TH>Client-Friendly-Name<TH>Event-Timestamp";
print "<TH>Port-Limit<TH>NAS-Port-Type<TH>Connect-Info<TH>Framed-Protocol<TH>Service-Type";
print "<TH>Authentication-Type<TH>NP-Policy-Name<TH>Reason-Code<TH>Class<TH>Session-Timeout";
print "<TH>Idle-Timeout<TH>Termination-Action<TH>EAP-Friendly-Name<TH>Acct-Status-Type";
print "<TH>Acct-Delay-Time<TH>Acct-Input-Octets<TH>Acct-Output-Octets<TH>Acct-Session-Id";
print "<TH>Acct-Authentic<TH>Acct-Session-Time<TH>Acct-Input-Packets<TH>Acct-Output-Packets";
print "<TH>Acct-Terminate-Cause<TH>Acct-Multi-Ssn-ID<TH>Acct-Link-Count<TH>Acct-Interim-Interval";
print "<TH>Tunnel-Type<TH>Tunnel-Medium-Type<TH>Tunnel-Client-Endpt<TH>Tunnel-Server-Endpt";
print "<TH>Acct-Tunnel-Connection<TH>Tunnel-Pvt-Group-ID<TH>Tunnel-Assignment-ID";
print "<TH>Tunnel-Preference<TH>MS-Acct-Auth-Type<TH>MS-Acct-EAP-Type<TH>MS-RAS-Version";
print "<TH>MS-RAS-Vendor<TH>MS-CHAP-Error<TH>MS-CHAP-Domain<TH>MS-MPPE-Encryption-Types";
print "<TH>MS-MPPE-Encryption-Policy";


while(<FILE>) {

    chomp;


    my @tmp = split /,/;
    $tmp[4] = Fix4($tmp[4]);
    $tmp[23] = Fix23($tmp[23]);
    $tmp[25] = Fix25($tmp[25]);

    print "<tr>";
    foreach my $f (@tmp) {
        $f = "&nbsp;" unless $f;
        print "<td>$f";
    }
    print "\n";
}

close FILE;


exit 0;

sub Fix4 {
    my $t = shift;

    return "1 Accept-Request" if $t == 1;
    return "2 Access-Accept" if $t == 2;
    return "3 Access-Reject" if $t == 3;
    return "4 Accounting-Request" if $t == 4;
    return $t;
}


sub Fix23 {
    my $t = shift;

    return "1 PAP" if $t == 1;
    return "2 CHAP" if $t == 2;
    return "3 MS-CHAP" if $t == 3;
    return "4 MS-CHAP v2" if $t == 4;
    return "5 EAP" if $t == 5;
    return "7 None" if $t == 7;
    return "8 Custom" if $t == 8;
    return $t;
}

sub Fix25 {

    my $t = shift;
    return "IAS_SUCCESS " if $t == 0;
    return "IAS_INTERNAL_ERROR " if $t == 1;
    return "IAS_ACCESS_DENIED " if $t == 2;
    return "IAS_MALFORMED_REQUEST " if $t == 3;
    return "IAS_GLOBAL_CATALOG_UNAVAILABLE " if $t == 4;
    return "IAS_DOMAIN_UNAVAILABLE " if $t == 5;
    return "IAS_SERVER_UNAVAILABLE " if $t == 6;
    return "IAS_NO_SUCH_DOMAIN " if $t == 7;
    return "IAS_NO_SUCH_USER " if $t == 8;
    return "IAS_AUTH_FAILURE " if $t == 16;
    return "IAS_CHANGE_PASSWORD_FAILURE " if $t == 17;
    return "IAS_UNSUPPORTED_AUTH_TYPE " if $t == 18;
    return "IAS_LOCAL_USERS_ONLY " if $t == 32;
    return "IAS_PASSWORD_MUST_CHANGE " if $t == 33;
    return "IAS_ACCOUNT_DISABLED " if $t == 34;
    return "IAS_ACCOUNT_EXPIRED " if $t == 35;
    return "IAS_ACCOUNT_LOCKED_OUT " if $t == 36;
    return "IAS_INVALID_LOGON_HOURS " if $t == 37;
    return "IAS_ACCOUNT_RESTRICTION " if $t == 38;
    return "IAS_NO_POLICY_MATCH " if $t == 48;
    return "IAS_DIALIN_LOCKED_OUT " if $t == 64;
    return "IAS_DIALIN_DISABLED " if $t == 65;
    return "IAS_INVALID_AUTH_TYPE " if $t == 66;
    return "IAS_INVALID_CALLING_STATION " if $t == 67;
    return "IAS_INVALID_DIALIN_HOURS " if $t == 68;
    return "IAS_INVALID_CALLED_STATION " if $t == 69;
    return "IAS_INVALID_PORT_TYPE " if $t == 70;
    return "IAS_INVALID_RESTRICTION " if $t == 71;
    return "IAS_NO_RECORD " if $t == 80;
    return "IAS_SESSION_TIMEOUT " if $t == 96;
    return "IAS_UNEXPECTED_REQUEST " if $t == 97;
    return $t;
}