A radius log file parser that displays radius users at a particular point in time. It takes a detail file and a datime/time value as parameter and displays usernames, framed-ip-address and nas-port as output.

Usage:

Make sure to set +x attribute to whowas.pl.
$ chmod +x whowas.pl


Software syntax:

$ whowas.pl <detail_file> <date_time>

e.g.

$ whowas.pl detail "2004-1-10 11:00:00"

The above line will display users currently logged in at "2004-1-10 11:00:00"

Code:
#!/usr/bin/perl
# John Homer H Alvero
# Jan. 11, 2004 

use HTTP::Date;

my $Line;
my @Record;
my $SearchTime = $ARGV[1]; #$ARGV[1];
my $SearchTimestamp = str2time($SearchTime); 

sub ProcessRec {
   my $Header;
   my %AuthRec; 
   my $Fieldname;
   my $Value;
   my $Login;
   my $Logout;
 
   $Header = $Record[0];

   for ($i = 1; $i <= $#Record; $i++) { 
      ($Fieldname, $Value) = split("=",$Record[$i]);
      $Fieldname =~ s/\t//g;
      $Fieldname =~ s/ //g;
      $Value =~ s/ //g;
      $Value =~ s/\"//g;
      chomp($Value); 
      $AuthRec{$Fieldname} = $Value;
   } 
 
   $Login = scalar($AuthRec{"Timestamp"}) -  scalar($AuthRec{"Acct-Session-Time"});
   $Logout = scalar($AuthRec{"Timestamp"});


   if ($AuthRec{"Acct-Status-Type"} =~ /Stop/) {
      if (($SearchTimestamp >= $Login) && ($SearchTimestamp <= $Logout)) {
          print $AuthRec{"User-Name"} . "\t\t" . $AuthRec{"Framed-IP-Address"} . "\t\t" . $AuthRec{"NAS-Port"} . "\n";
          }
   }
}

open(FILE1,$ARGV[0]);

while () {
   $Line = $_;
   if ($Line eq "\n") {
        ProcessRec;
        @Record = ();
        end;
   } else {
        push @Record, $Line;
   }
}

close(FILE1);
You can also download the file here.