Subject: afpd login tracker script

From: Benjamin Gilbert <[email-masked]>
Date: Mon, 27 Mar 2000 20:29:40 -0600

[sorry for the crosspost...]

Here's my contribution to the flurry of login-source retrieval scripts on 
netatalk-admins the past few days.  I wrote this script last September 
when we needed it in-house, and I never got around to releasing it until 
now.  Like some of the other scripts, this one parses the syslog to 
retrieve its information; unlike the others, this one runs as a daemon.  
This is possibly evil, but it does make things somewhat easier.

Things atalklogger can do:
- Maintain a file listing users currently logged on, the pids of their 
afpd processes, and the client machine they're coming from
- Maintain a similar file telling what machines are printing to papd, the 
associated papd pids, and what spools they're printing to
- Generate a log file of users' AFP logins and logouts, including 
timestamps, pids, client machines, usernames, and amount of data 
transferred

atalklogger can be configured to call nbplkup every couple minutes and 
maintain a DDP -> NBP conversion table so that it can report NBP names 
instead of DDP addresses.  To convert IP addresses to hostnames, the only 
mechanism currently supported is direct reading of /etc/hosts (we're on a 
LAN block without DNS, so a more generalized approach wasn't needed).  It 
should be fairly trivial to add DNS support via the Scotty Tcl extension, 
but I haven't had the time.  Patches are welcome.

We've been running (a slightly different version of) the code in-house 
since last September.  I don't claim it's great code, but it certainly 
works for us.

System requirements (the known ones, anyway):
- netatalk+asun 2.1.3 or pre-2.1.4
- Tcl 8.0 or above
- TclX 8.0 or above

You can get atalklogger at:
<http://prism.simplenet.com/atalklogger.tcl.gz>
Documentation, such as it is, is at the top of the file.

Hope this helps someone.

--Benjamin Gilbert