# ✅ Correct - check multiple mobile indicators
mobile_indicators = ['mobile', 'iphone', 'android', 'ipad']
is_mobile = any(
    indicator in user_agent.lower()
    for indicator in mobile_indicators
)

# ❌ Wrong - too narrow
'Mobile' in user_agent              # case sensitive
user_agent.startswith('Mozilla/5.0 (Mobile')  # too specific
'webkit' in user_agent.lower()      # webkit used by desktop too

from collections import Counter

# Count checkout transactions by product category
# URLs like: /checkout/electronics/, /checkout/clothing/
Counter(
    url.split('/')[2]
    for url in filtered_checkout_urls
    if len(url.split('/')) > 2
)
# Result: {'electronics': 45, 'clothing': 32, 'food': 18}

# Validate each filter step by step
all_entries = parse_log('access.log')

# Step 1: Check time filter
time_filtered = [e for e in all_entries
                 if 12 <= e['timestamp'].hour <= 15]
print(f"After time filter: {len(time_filtered)}")

# Step 2: Check method filter
method_filtered = [e for e in time_filtered
                   if e['method'] == 'POST']
print(f"After method filter: {len(method_filtered)}")

# Step 3: Check URL filter
url_filtered = [e for e in method_filtered
                if e['url'].startswith('/checkout/')]
print(f"After URL filter: {len(url_filtered)}")

# Step 4: Check status filter
final = [e for e in url_filtered
         if 200 <= e['status'] < 300]
print(f"Final count: {len(final)}")

# ✅ Must apply BOTH filters before counting
filtered = [
    e for e in entries
    if e['url'].startswith('/error/')    # URL filter
    and e['status'] == 404              # status filter
]
count = len(filtered)

# ❌ Wrong - counts everything in filtered_entries
# without applying the second filter (status==404)
len(filtered_entries)   # if filtered_entries only has URL filter applied

import gzip

# ✅ Read gzipped log file
with gzip.open('access.log.gz', 'rt') as f:
    for line in f:          # generator - memory efficient
        process(line)

# ✅ Memory efficient - one line at a time
with open('access.log') as f:
    for line in f:
        process(line)

# ❌ Loads entire file into memory
lines = open('access.log').readlines()

import gzip
from datetime import datetime

def parse_log_line(line):
    """Parse single Apache log line"""
    import shlex
    try:
        parts = shlex.split(line)   # handles quoted fields correctly
        return {
            'ip': parts[0],
            'timestamp': datetime.strptime(
                parts[3].strip('[]'),
                '%d/%b/%Y:%H:%M:%S %z'    # ✅ exam format
            ),
            'method': parts[5],           # split(' ')[0] of request
            'url': parts[6],              # split(' ')[1] of request ✅
            'protocol': parts[7],         # split(' ')[2] of request ✅
            'status': int(parts[8]),
            'size': parts[9],
            'user_agent': parts[11]
        }
    except:
        return None

def analyze_log(filepath):
    results = []
    
    # Handle both gzipped and plain files
    opener = gzip.open if filepath.endswith('.gz') else open
    
    with opener(filepath, 'rt') as f:
        for line in f:                    # ✅ generator pattern
            entry = parse_log_line(line.strip())
            if entry:
                results.append(entry)
    
    return results

entries = analyze_log('access.log.gz')

# Filter by time range
peak_hour = [e for e in entries
             if 12 <= e['timestamp'].hour <= 15]  # ✅

# Filter by weekday
mondays = [e for e in entries
           if e['timestamp'].weekday() == 0]       # ✅ 0=Monday

# Filter POST to /checkout/
checkouts = [e for e in entries
             if e['method'] == 'POST'
             and e['url'].startswith('/checkout/')] # ✅

# Filter successful requests
successful = [e for e in entries
              if 200 <= e['status'] < 300]         # ✅

# Filter mobile traffic
mobile = [e for e in entries
          if any(m in e['user_agent'].lower()
                 for m in ['mobile','iphone','android','ipad'])]  # ✅

# Filter redirects
redirects = [e for e in entries
             if 300 <= e['status'] < 400]          # ✅