"""
Generates a modest sshd-style auth log (a few tens of MB - nowhere near
"large" by server standards) with a handful of IPs brute-forcing logins
mixed in among normal traffic.

Run once:  python3 generate_log.py
"""

import random
from pathlib import Path

LOG_FILE = Path(__file__).parent / "auth.log"
NUM_LINES = 300_000

# Uncomment to create a 5GB log file.
#NUM_LINES = 50_000_000

random.seed(42)

USERS = ["deploy", "sebastiaan", "backup", "www-data", "postgres"]
NORMAL_IPS = [f"10.0.0.{i}" for i in range(1, 40)]
ATTACKER_IPS = ["203.0.113.7", "198.51.100.23", "192.0.2.99"]  # brute-forcing these


def make_line(i: int) -> str:
    ts = f"2026-09-09 {i % 24:02d}:{i % 60:02d}:{(i * 7) % 60:02d}"
    if random.random() < 0.15:
        ip = random.choice(ATTACKER_IPS)
        user = random.choice(["root", "admin", "test", "oracle"])
        return f"{ts} host01 sshd[1234]: Failed password for {user} from {ip} port 51222 ssh2\n"
    ip = random.choice(NORMAL_IPS)
    user = random.choice(USERS)
    return f"{ts} host01 sshd[1234]: Accepted publickey for {user} from {ip} port 55010 ssh2\n"


def main():
    with open(LOG_FILE, "w") as f:
        for i in range(NUM_LINES):
            f.write(make_line(i))
    size_mb = LOG_FILE.stat().st_size / 1_000_000
    print(f"Wrote {NUM_LINES:,} lines to {LOG_FILE} ({size_mb:.1f} MB)")


if __name__ == "__main__":
    main()