#!/bin/bash
LOG="/var/www/we8upmb/htdocs/logs/luftbude.de-access.log"
TOP=10
LIMIT=5

[[ ! -f "$LOG" ]] && { echo "Log-Datei nicht gefunden: $LOG"; exit 1; }

echo "Analysiere $(wc -l < "$LOG") Requests..."
echo "======================================"

# === API-SPEZIFISCHE ANALYSE ===
echo ""
echo "=== API-TRAFFIC ÜBERSICHT ==="
api_total=$(grep -c '/api/' "$LOG")
total=$(wc -l < "$LOG")
echo "API-Requests: $api_total von $total gesamt ($(($api_total * 100 / $total))%)"

echo ""
echo "=== TOP API-Endpoints (mit Query-Parametern) ==="
grep '/api/' "$LOG" | awk '{print $7}' | sort | uniq -c | sort -rn | head -n 20

echo ""
echo "=== TOP API-Endpoints (gruppiert ohne Query-Parameter) ==="
grep '/api/' "$LOG" | awk '{
    url = $7
    # Entferne Query-Parameter
    sub(/\?.*/, "", url)
    # Ersetze numerische IDs mit :id
    gsub(/\/[0-9]+/, "/:id", url)
    print url
}' | sort | uniq -c | sort -rn | head -n 20

echo ""
echo "=== TOP IP → API-Endpoint Kombinationen ==="
grep '/api/' "$LOG" | awk '{
    url = $7
    sub(/\?.*/, "", url)
    gsub(/\/[0-9]+/, "/:id", url)
    print $1 " → " url
}' | sort | uniq -c | sort -rn | head -n 20

echo ""
echo "=== API Response Codes ==="
grep '/api/' "$LOG" | awk '{print $9}' | sort | uniq -c | sort -rn

echo ""
echo "=== API Request Methods ==="
grep '/api/' "$LOG" | awk '{print $6}' | tr -d '"' | sort | uniq -c | sort -rn

echo ""
echo "=== Response Sizes (Bytes) ==="
grep '/api/' "$LOG" | awk '{print $10}' | awk '
    {
        sum+=$1; count++; 
        if($1>max) max=$1; 
        if(min=="" || $1<min) min=$1
    } 
    END {
        if(count>0) {
            avg = sum/count
            printf "Min: %d bytes, Max: %d bytes, Avg: %.0f bytes, Total: %.2f MB\n", 
                   min, max, avg, sum/1024/1024
        }
    }
'

echo ""
echo "=== Größte API-Responses (Top 10) ==="
grep '/api/' "$LOG" | awk '{print $10, $1, $7}' | sort -rn | head -n 10 | awk '{printf "%10d bytes - %s - %s\n", $1, $2, $3}'

echo ""
echo "======================================"
echo ""

# === SEKUNDEN MIT MEISTEN API-CALLS ===
echo "=== Top $TOP Sekunden mit meisten API-Requests ==="
grep '/api/' "$LOG" | awk '{print substr($4,2,20)}' | sort | uniq -c | sort -rn | head -n $TOP | while read count second; do
    echo ""
    echo "=== Sekunde: $second ($count API-Requests) ==="
    
    second_data=$(grep '/api/' "$LOG" | awk -v s="$second" 'substr($4,2,20) == s')
    
    echo "-- Top IP → Endpoint --"
    echo "$second_data" | awk '{
        url = $7
        sub(/\?.*/, "", url)
        gsub(/\/[0-9]+/, "/:id", url)
        print $1 " → " url
    }' | sort | uniq -c | sort -rn | head -n $LIMIT
    
    echo "-- Response Codes --"
    echo "$second_data" | awk '{print $9}' | sort | uniq -c | sort -rn
    
    echo "-- Request Methods --"
    echo "$second_data" | awk '{print $6}' | tr -d '"' | sort | uniq -c | sort -rn
    
    echo "-- Durchschnittliche Response Size --"
    echo "$second_data" | awk '{sum+=$10; count++} END {if(count>0) printf "%.0f bytes\n", sum/count}'
    
    echo "------------------------------"
done

echo ""
echo "=== VERDÄCHTIGE PATTERNS ==="

echo ""
echo "-- Häufige 404s auf /api/ --"
grep '/api/' "$LOG" | awk '$9 == 404 {print $1, $7}' | sort | uniq -c | sort -rn | head -n 10

echo ""
echo "-- Häufige 500er auf /api/ --"
grep '/api/' "$LOG" | awk '$9 ~ /^5/ {print $1, $7}' | sort | uniq -c | sort -rn | head -n 10

echo ""
echo "-- IPs mit >100 API-Requests --"
grep '/api/' "$LOG" | awk '{print $1}' | sort | uniq -c | sort -rn | awk '$1 > 100 {print $1, $2}'

echo ""
echo "-- Ungewöhnliche User-Agents auf /api/ --"
grep '/api/' "$LOG" | awk '{split($0,a,"\""); print a[6]}' | sort | uniq -c | sort -rn | head -n 15