python: LogParser + Emailer

Tested.
In use at work.
"If I return too many results, I cause a BSOD. I eat your non-paged pool for breakfast."

to do: if query returns over 50 lines, prompt to continue... option to suppress this prompt. option to suppress command-line output.
Currently, the --parse option must fall before any other option in order to have the program function properly. This is to reduce the use of Global variables.

### input: me.py --file [syslog file] --find [find string] | --parse [comma-seperated list of tokens],[delimiter] | --email [email address]
### --email is an optional argument, and can be a single email address or a semi-colon seperated list
### output: return line(s) where string is located

### handle arguments (requiring both --file and --find)
### check if input file exists
### open file for read
#### read line by line checking to see if --find [string] is located
#### create an array and write the lines to it
### close file
### print contents of array
### if email argument exists, send email to given address

import sys
import getopt
import os


def main():

    Arguments()

def Arguments():

    # the main purpose of this function is to only evaluate arguments.
    # it is not really to be used to perform other functions, but to call other functions.


    try:
        opts, args = getopt.getopt(sys.argv[1:], "f:,q:,p:,e:,d:,", ["file=", "find=", "parse=", "email=",])
    except getopt.GetoptError, err:
        YouErroredMe(str(err))


    if len(sys.argv) == 1:
        YouNeedHelp()


    for opt, arg in opts:

        if opt in ( "--parse" ): #take delimiter, and tokens
            try:
                #take the characters in the string to the left of the first : (from the left) :
                strTokens = arg[0:arg.find(":")]
                #make a list of these comma-seperated tokens, by using the string.split function :
                global Tokens
                Tokens = strTokens.split(",")
                if len(Tokens) < 1:
                    YouErroredMe("You must give me some tokens.  You want me to return nothing?")
                #take the characters in the string to the right of the first : (from the left) :
                global Delimiter
                Delimiter = arg[arg.find(":")+1:len(arg)]
                if len(Delimiter) < 1:
                    YouErroredMe("You must give me a delimiter with your tokens.  You want me to return the whole line?")
            except:
                continue
        elif opt in ( "--file" ):
            strInputFile = arg
            CheckIfFileExists( strInputFile )
        elif opt in ( "--find" ):
            strFindString = arg
            CheckForStringInFile( strInputFile, strFindString )
        elif opt in ("--email"):
            try: #should be checking if Lines exists/has any members, what the vartype is???
                strEmailAddress = arg
                strEmailAddress = strEmailAddress.split(";")
                Mailer( "ParserAlert", strEmailAddress, "Found " + strFindString + " in " + strInputFile, Lines)
            except:
                continue



def CheckIfFileExists( passFileName ):

    if os.path.getsize( passFileName ) == 0:
        YouErroredMe( "The file provided is 0 long.  Give me some sugar." )

def CheckForStringInFile( passFileName, passFindString ):
    objFile = open ( passFileName )

    global Lines
    Lines = "\n"
    FoundLines = []
    for line in objFile:
        if line.count( passFindString ) <> 0:
            FoundLines.append(line)


    for line in FoundLines:

        #if parse tokens and delimiter exist...
        try:
            if len(Tokens) > 0:
                for item in Tokens:
                    Lines = Lines + line.split(str(Delimiter))[int(item)] + "\n"
        except:
            Lines = Lines + line

    print Lines


    if len(FoundLines) < 1:
        print "String " + passFindString + " not found in file " + passFileName + "."
        objFile.close
        sys.exit()

    objFile.close



def Mailer( passFromAddr, passToAddr, passSubject, passMessage ):

    import smtplib

    FROM = passFromAddr
    TO = passToAddr
    SUBJECT = passSubject
    TEXT = passMessage

    # Prepare actual message
    message = "From: %s\r\nTo: %s\r\nSubject: %s\r\n\r\n %s" % (FROM, TO, SUBJECT, TEXT)

    # Send the mail
    server = smtplib.SMTP( "domain.com" )
    errStatus = server.sendmail(FROM, TO, message)
    for errorItem in errStatus:
        print ""
        print "SMTP Error: " + errorItem
##        LogMe( "ERROR,smtp,%m,%d,%Y,%H:%M:%S,domain.com," + FROM + "," + TO + "," + errorItem )
    server.quit()
    return





def YouErroredMe( passError ):

    print ""
    print passError
    print "/\\__/\\"
    print ""
    YouNeedHelp()
    return


def YouNeedHelp():

    print ""
    print "input: me.py --parse [tokens]:[delimiter] --file [log file] --find [find string] --email [email address]"
    print ""
    print ""
    print "--parse is an optional argument and must be before --file or --find.  It can be a comma-seperated list of tokens, followed by a colon, followed by the delimiter.  It will return this given subset only."
    print "--email is an optional argument.  It can be a single Email address, or a semi-colon seperated list."
    print ""
    print "output: return line(s) where string is located"
    print ""
    print "Examples:"
    print "me.py --file syslog.txt --find subtype=sslvpn --email mbrown@domain.com"
    print "me.py --file syslog.txt --find subtype=sslvpn --email mbrown@domain.com;helpdesk@domain.com"
    print "me.py --parse 5,6,7:; --file syslog.txt --find subtype=sslvpn --email mbrown@domain.com;helpdesk@domain.com"
    sys.exit()
    return


main()

Output from a syslog from a Fortinet:


logparser.py --parse 0,4,9,10,11,12,13,14:, --file syslog.log --find sslvpn


Jan 4 13:27:55 192.168.1.1 date=2009-01-04
log_id=0132099601
user="username"
rip="4.2.2.1"
action=login
status=success
reason=none
msg="User username login successfully from 4.2.2.1"

Jan 4 13:36:13 192.168.1.1 date=2009-01-04
log_id=0132099604
user="username"
rip=4.2.2.1
action=logout
status=success
reason=timeout
msg="SSL VPN web access session timeout from 4.2.2.1"