Code – Ultra Trail Running

Copy to Clipboard

# ========== CONFIGURACIÓN ==========
$logPath = "C:\inetpub\logs\LogFiles\FTPSVC1"
$exportFolder = "$env:USERPROFILE\Desktop"

# ========== SOLICITAR FECHAS ==========
$startDateInput = Read-Host "Ingrese la fecha de inicio (yyyy-MM-dd)"
$endDateInput   = Read-Host "Ingrese la fecha de fin    (yyyy-MM-dd)"
try {
    $startDate = [datetime]::ParseExact($startDateInput, "yyyy-MM-dd", $null)
    $endDate   = [datetime]::ParseExact($endDateInput, "yyyy-MM-dd", $null)
} catch {
    Write-Error "Formato de fecha inválido. Usa yyyy-MM-dd. Ejemplo: 2025-04-20"
    exit
}

# ========== INICIALIZACIÓN ==========
$allAccesses = @()
$loginFailures = @()
$fileActions = @()

# ========== PROCESAR LOGS ==========
Get-ChildItem -Path $logPath -Filter *.log | ForEach-Object {
    if ($_.Name -match "(\d{8})") {
        $logDate = [datetime]::ParseExact($matches[1], "yyyyMMdd", $null)
        if ($logDate -ge $startDate -and $logDate -le $endDate) {
            Get-Content $_.FullName | Where-Object { $_ -notmatch "^#" } | ForEach-Object {
                $fields = $_ -split ' '
                if ($fields.Length -ge 15) {
                    $entry = [PSCustomObject]@{
                        Date        = $fields[0]
                        Time        = $fields[1]
                        ClientIP    = $fields[2]
                        Username    = $fields[3]
                        Command     = $fields[8]
                        UriStem     = $fields[9]
                        StatusCode  = $fields[11]
                        BytesSent   = $fields[13]
                        BytesRecv   = $fields[14]
                    }

$allAccesses += $entry

if ($entry.Command -like "*USER*" -and $entry.StatusCode -eq "530") {
                        $loginFailures += $entry
                    }

if ($entry.Command -match "RETR|STOR|DELE|MKD|RMD|RNFR|RNTO") {
                        $fileActions += $entry
                    }
                }
            }
        }
    }
}

# ========== AGRUPAR POR USUARIO ==========
$userStats = $allAccesses | Where-Object { $_.Username -ne "-" } |
    Group-Object Username | Select-Object Name, Count

# ========== EXPORTAR CSV ==========
$allCsv         = Join-Path $exportFolder "ftp_accesos_completos.csv"
$failCsv        = Join-Path $exportFolder "ftp_login_fallidos.csv"
$userSummaryCsv = Join-Path $exportFolder "ftp_accesos_por_usuario.csv"
$fileActionsCsv = Join-Path $exportFolder "ftp_acciones_archivo.csv"

if ($allAccesses.Count -gt 0)     { $allAccesses     | Export-Csv $allCsv -NoTypeInformation -Encoding UTF8 }
if ($loginFailures.Count -gt 0)   { $loginFailures   | Export-Csv $failCsv -NoTypeInformation -Encoding UTF8 }
if ($userStats.Count -gt 0)       { $userStats       | Export-Csv $userSummaryCsv -NoTypeInformation -Encoding UTF8 }
if ($fileActions.Count -gt 0)     { $fileActions     | Export-Csv $fileActionsCsv -NoTypeInformation -Encoding UTF8 }

# ========== GENERAR HTML ==========
$reportPath = Join-Path $exportFolder "Reporte_FTP.html"
$htmlHeader = @"
<!DOCTYPE html>
<html>
<head>
    <meta charset="UTF-8">
    <title>Reporte de Accesos FTP</title>
    <style>
        body { font-family: Arial; background-color: #f9f9f9; color: #333; padding: 20px; }
        h1, h2 { color: #005a9c; }
        table { border-collapse: collapse; width: 100%; margin-bottom: 30px; }
        th, td { border: 1px solid #ccc; padding: 8px; text-align: left; }
        th { background-color: #0078d7; color: white; }
        tr:nth-child(even) { background-color: #f0f0f0; }
    </style>
</head>
<body>
<h1>Reporte de Accesos FTP</h1>
<p>Rango de fechas: <strong>$($startDate.ToShortDateString())</strong> a <strong>$($endDate.ToShortDateString())</strong></p>
"@

$userTable = "<h2>Resumen por Usuario</h2><table><tr><th>Usuario</th><th>Accesos</th></tr>"
foreach ($user in $userStats) {
    $userTable += "<tr><td>$($user.Name)</td><td>$($user.Count)</td></tr>"
}
$userTable += "</table>"

if ($loginFailures.Count -gt 0) {
    $failTable = "<h2>Intentos Fallidos de Login</h2><table><tr><th>Fecha</th><th>Hora</th><th>IP</th><th>Usuario</th><th>Status</th></tr>"
    foreach ($fail in $loginFailures) {
        $failTable += "<tr><td>$($fail.Date)</td><td>$($fail.Time)</td><td>$($fail.ClientIP)</td><td>$($fail.Username)</td><td>$($fail.StatusCode)</td></tr>"
    }
    $failTable += "</table>"
} else {
    $failTable = "<p><em>No se detectaron intentos fallidos de login.</em></p>"
}

if ($fileActions.Count -gt 0) {
    $fileTable = "<h2>Auditoría de Archivos (RETR, STOR, DELE...)</h2><table><tr><th>Fecha</th><th>Hora</th><th>IP</th><th>Usuario</th><th>Comando</th><th>Status</th></tr>"
    foreach ($entry in $fileActions) {
        $fileTable += "<tr><td>$($entry.Date)</td><td>$($entry.Time)</td><td>$($entry.ClientIP)</td><td>$($entry.Username)</td><td>$($entry.Command)</td><td>$($entry.StatusCode)</td></tr>"
    }
    $fileTable += "</table>"
} else {
    $fileTable = "<p><em>No se detectaron acciones de archivos durante el período.</em></p>"
}

$htmlFooter = "</body></html>"
$htmlContent = $htmlHeader + $userTable + $failTable + $fileTable + $htmlFooter
$htmlContent | Out-File -FilePath $reportPath -Encoding UTF8

# ========== SALIDA ==========
Write-Host "`n✅ Reporte generado correctamente:"
Write-Host "📁 HTML: $reportPath"
Write-Host "📄 CSVs:"
Write-Host "    $allCsv"
Write-Host "    $failCsv"
Write-Host "    $userSummaryCsv"
if ($fileActions.Count -gt 0) {
    Write-Host "    $fileActionsCsv"
}
Write-Host ""