#!/bin/bash
# 文件名：/opt/scripts/system_monitor.sh
# 功能：綜合系統(tǒng)狀態(tài)監(jiān)控，適合加入cron定時(shí)執(zhí)行
# 執(zhí)行頻率：建議每5分鐘一次

LOG_FILE="/var/log/system_monitor.log"
THRESHOLD_CPU=80     # CPU使用率閾值%
THRESHOLD_MEM=85     # 內(nèi)存使用率閾值%
THRESHOLD_DISK=90    # 磁盤使用率閾值%

# 獲取當(dāng)前時(shí)間
echo "====== $(date '+%Y-%m-%d %H:%M:%S') ======" | tee -a $LOG_FILE

# 1. CPU監(jiān)控
CPU_USAGE=$(top -bn1 | grep "Cpu(s)" | awk '{print $2}' | cut -d'%' -f1)
if (( $(echo "$CPU_USAGE > $THRESHOLD_CPU" | bc -l) )); then
    echo "??  警告：CPU使用率過高 - ${CPU_USAGE}%" | tee -a $LOG_FILE
    # 這里可以添加告警動(dòng)作，如發(fā)送郵件
    # /opt/scripts/send_alert.sh "CPU報(bào)警" "CPU使用率: ${CPU_USAGE}%"
fi

# 2. 內(nèi)存監(jiān)控
MEM_TOTAL=$(free -m | awk '/Mem:/ {print $2}')
MEM_USED=$(free -m | awk '/Mem:/ {print $3}')
MEM_PERCENT=$((MEM_USED*100/MEM_TOTAL))
if [ $MEM_PERCENT -gt $THRESHOLD_MEM ]; then
    echo "??  警告：內(nèi)存使用率過高 - ${MEM_PERCENT}%" | tee -a $LOG_FILE
    # 顯示內(nèi)存占用前10的進(jìn)程
    ps aux --sort=-%mem | head -11 | tee -a $LOG_FILE
fi

# 3. 磁盤監(jiān)控
df -h | grep -E '^/dev/' | while read line; do
    USAGE=$(echo $line | awk '{print $5}' | sed 's/%//')
    MOUNT=$(echo $line | awk '{print $6}')
    if [ $USAGE -gt $THRESHOLD_DISK ]; then
        echo "??  警告：磁盤 $MOUNT 使用率過高 - ${USAGE}%" | tee -a $LOG_FILE
    fi
done

# 4. 關(guān)鍵進(jìn)程檢查
PROCESS_LIST=("nginx" "mysql" "redis" "sshd")
for proc in "${PROCESS_LIST[@]}"; do
    if ! pgrep -x "$proc" >/dev/null; then
        echo "? 關(guān)鍵進(jìn)程 $proc 未運(yùn)行！" | tee -a $LOG_FILE
    fi
done

# 5. 連接數(shù)監(jiān)控（針對(duì)Web服務(wù)器）
if command -v netstat &> /dev/null; then
    CONN_COUNT=$(netstat -ant | grep -c ESTABLISHED)
    echo "當(dāng)前ESTABLISHED連接數(shù): $CONN_COUNT" | tee -a $LOG_FILE
fi

echo "監(jiān)控完成" | tee -a $LOG_FILE

#!/bin/bash
# 文件名：/opt/scripts/process_watch.sh
# 功能：監(jiān)控指定進(jìn)程的資源占用，類似簡易版top
# 用法：./process_watch.sh <進(jìn)程名或PID>

PROCESS_NAME=$1
INTERVAL=2  # 監(jiān)控間隔（秒）

if [ -z "$PROCESS_NAME" ]; then
    echo "用法: $0 <進(jìn)程名或PID>"
    exit 1
fi

echo "監(jiān)控進(jìn)程: $PROCESS_NAME，按Ctrl+C退出"
echo "時(shí)間戳          PID   CPU%   MEM%   虛擬內(nèi)存   物理內(nèi)存   進(jìn)程名"
echo "----------------------------------------------------------------"

while true; do
    # 通過ps獲取進(jìn)程信息
    ps aux | grep -E "(PID|$PROCESS_NAME)" | grep -v grep | grep -v $0 | \
    awk -v date="$(date '+%H:%M:%S')" '{
        printf "%s %6s %5s %6s %10s %10s   %s\n", 
        date, $2, $3, $4, $5, $6, $11
    }'
    
    # 顯示進(jìn)程打開的文件數(shù)（如果進(jìn)程存在）
    PID=$(ps aux | grep "$PROCESS_NAME" | grep -v grep | head -1 | awk '{print $2}')
    if [ ! -z "$PID" ]; then
        FILE_COUNT=$(ls -l /proc/$PID/fd 2>/dev/null | wc -l)
        echo "  打開文件數(shù): ${FILE_COUNT:-N/A}"
    fi
    
    sleep $INTERVAL
done

#!/bin/bash
# 文件名：/opt/scripts/smart_backup.sh
# 功能：增量備份，保留最近7天，每周日全量備份
# 配置：修改SOURCE_DIR和BACKUP_DIR

SOURCE_DIR="/data/www"           # 備份源目錄
BACKUP_DIR="/backup/www"         # 備份目標(biāo)目錄
RETENTION_DAYS=7                 # 保留天數(shù)
DATE=$(date '+%Y%m%d_%H%M%S')
BACKUP_LOG="/var/log/backup_${DATE}.log"

# 創(chuàng)建目錄
mkdir -p $BACKUP_DIR/{full,incremental}

# 日志函數(shù)
log() {
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" | tee -a $BACKUP_LOG
}

# 檢查磁盤空間
check_disk_space() {
    local required=$1
    local available=$(df $BACKUP_DIR | awk 'NR==2 {print $4}')
    
    if [ $available -lt $required ]; then
        log "? 磁盤空間不足！可用: ${available}KB, 需要: ${required}KB"
        exit 1
    fi
}

# 周日做全量備份，其他天做增量備份
if [ $(date '+%u') -eq 7 ]; then
    BACKUP_TYPE="full"
    BACKUP_PATH="$BACKUP_DIR/full/backup_${DATE}.tar.gz"
    
    # 估算大?。▎挝籏B）
    EST_SIZE=$(du -sk $SOURCE_DIR | awk '{print $1}')
    check_disk_space $((EST_SIZE * 110 / 100))  # 增加10%緩沖
    
    log "開始全量備份..."
    tar -czf $BACKUP_PATH $SOURCE_DIR 2>>$BACKUP_LOG
    
    # 刪除舊的全量備份
    find $BACKUP_DIR/full -type f -mtime +$RETENTION_DAYS -delete
    
else
    BACKUP_TYPE="incremental"
    LATEST_FULL=$(ls -t $BACKUP_DIR/full/*.tar.gz 2>/dev/null | head -1)
    
    if [ -z "$LATEST_FULL" ]; then
        log "未找到全量備份，執(zhí)行全量備份..."
        $0 --force-full
        exit 0
    fi
    
    BACKUP_PATH="$BACKUP_DIR/incremental/inc_${DATE}.tar.gz"
    
    # 查找需要備份的修改文件（最近24小時(shí)內(nèi)）
    find $SOURCE_DIR -type f -mtime -1 -print > /tmp/changed_files.list
    
    if [ -s /tmp/changed_files.list ]; then
        tar -czf $BACKUP_PATH -T /tmp/changed_files.list 2>>$BACKUP_LOG
        log "增量備份完成，文件數(shù): $(wc -l < /tmp/changed_files.list)"
    else
        log "沒有文件變化，跳過備份"
    fi
    
    rm -f /tmp/changed_files.list
fi

# 驗(yàn)證備份文件
if [ -f $BACKUP_PATH ]; then
    BACKUP_SIZE=$(du -h $BACKUP_PATH | awk '{print $1}')
    log "? 備份成功: $BACKUP_TYPE備份, 大小: $BACKUP_SIZE, 路徑: $BACKUP_PATH"
    
    # 發(fā)送成功通知（可選）
    # echo "備份成功: $(hostname) - $BACKUP_TYPE" | mail -s "備份成功通知" admin@example.com
else
    log "? 備份失??！"
    exit 1
fi

# 清理舊日志
find /var/log/ -name "backup_*.log" -mtime +30 -delete

#!/bin/bash
# 文件名：/opt/scripts/mysql_backup.sh
# 功能：MySQL數(shù)據(jù)庫備份，支持單庫、多庫、全庫
# 配置前請(qǐng)先設(shè)置MySQL連接信息

MYSQL_USER="backup"
MYSQL_PASS="your_password"
MYSQL_HOST="localhost"
BACKUP_DIR="/backup/mysql"
RETENTION_DAYS=30
DATE=$(date '+%Y%m%d')
TIME=$(date '+%H%M')

# 創(chuàng)建備份目錄
mkdir -p $BACKUP_DIR/{full,binlog}

# 1. 全量備份
log() {
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1"
}

# 備份所有數(shù)據(jù)庫
log "開始MySQL全量備份..."
mysqldump -h$MYSQL_HOST -u$MYSQL_USER -p$MYSQL_PASS \
    --all-databases \
    --single-transaction \
    --routines \
    --triggers \
    --events \
    --flush-logs \
    --master-data=2 \
    | gzip > $BACKUP_DIR/full/all_dbs_${DATE}_${TIME}.sql.gz

# 檢查備份是否成功
if [ ${PIPESTATUS[0]} -eq 0 ]; then
    log "? 全量備份成功"
    
    # 2. 備份Binlog（如果開啟了二進(jìn)制日志）
    if mysql -h$MYSQL_HOST -u$MYSQL_USER -p$MYSQL_PASS -e "SHOW BINARY LOGS" &>/dev/null; then
        log "開始備份二進(jìn)制日志..."
        mysql -h$MYSQL_HOST -u$MYSQL_USER -p$MYSQL_PASS -e "PURGE BINARY LOGS BEFORE DATE_SUB(NOW(), INTERVAL 7 DAY)"
        cp $(mysql -h$MYSQL_HOST -u$MYSQL_USER -p$MYSQL_PASS -e "SHOW VARIABLES LIKE 'log_bin_basename'" -sN | awk '{print $2}')* $BACKUP_DIR/binlog/ 2>/dev/null
    fi
    
    # 3. 清理舊備份
    find $BACKUP_DIR/full -name "*.sql.gz" -mtime +$RETENTION_DAYS -delete
    find $BACKUP_DIR/binlog -name "mysql-bin.*" -mtime +7 -delete
    
else
    log "? 備份失??！"
    exit 1
fi

#!/bin/bash
# 文件名：/opt/scripts/security_audit.sh
# 功能：系統(tǒng)安全基線檢查

REPORT_FILE="/var/log/security_audit_$(date '+%Y%m%d').txt"

echo "========== 系統(tǒng)安全審計(jì)報(bào)告 ==========" > $REPORT_FILE
echo "主機(jī)名: $(hostname)" >> $REPORT_FILE
echo "審計(jì)時(shí)間: $(date)" >> $REPORT_FILE
echo "=====================================" >> $REPORT_FILE

check_item() {
    echo -e "\n[檢查項(xiàng) $1] $2" | tee -a $REPORT_FILE
}

# 1. 檢查空密碼賬戶
check_item "1" "檢查空密碼賬戶"
awk -F: '($2 == "") {print $1}' /etc/shadow >> $REPORT_FILE

# 2. 檢查SUID特殊權(quán)限文件
check_item "2" "檢查SUID權(quán)限文件"
find / -perm -4000 -type f 2>/dev/null | head -20 >> $REPORT_FILE

# 3. 檢查最近登錄
check_item "3" "最近成功登錄"
last -n 10 >> $REPORT_FILE

check_item "4" "最近失敗登錄"
lastb -n 10 2>/dev/null >> $REPORT_FILE

# 4. 檢查ssh配置
check_item "5" "SSH配置檢查"
grep -E "^PermitRootLogin|^PasswordAuthentication|^Protocol" /etc/ssh/sshd_config 2>/dev/null >> $REPORT_FILE

# 5. 檢查開放端口
check_item "6" "監(jiān)聽端口檢查"
if command -v ss &> /dev/null; then
    ss -tulnp | grep LISTEN >> $REPORT_FILE
else
    netstat -tulnp | grep LISTEN >> $REPORT_FILE
fi

# 6. 檢查系統(tǒng)服務(wù)
check_item "7" "危險(xiǎn)服務(wù)檢查"
for service in telnet vsftpd rsh rexec rlogin; do
    systemctl is-enabled $service 2>/dev/null | grep -q "enabled" && echo "$service 服務(wù)已啟用" >> $REPORT_FILE
done

echo -e "\n========== 審計(jì)完成 ==========" >> $REPORT_FILE
echo "報(bào)告已保存至: $REPORT_FILE"

#!/bin/bash
# 文件名：/opt/scripts/log_analyzer.sh
# 功能：分析指定日志文件的異常情況
# 用法：./log_analyzer.sh <日志文件路徑>

LOG_FILE=$1
TEMP_FILE="/tmp/log_analysis_$$.tmp"

if [ ! -f "$LOG_FILE" ]; then
    echo "文件不存在: $LOG_FILE"
    exit 1
fi

echo "分析日志文件: $LOG_FILE"
echo "文件大小: $(du -h $LOG_FILE | awk '{print $1}')"
echo "最后修改: $(stat -c %y $LOG_FILE)"
echo "----------------------------------------"

# 1. 提取錯(cuò)誤級(jí)別日志
echo -e "\n1. 錯(cuò)誤級(jí)別日志統(tǒng)計(jì):"
grep -i -E "(error|fatal|failed|exception|segmentation fault)" $LOG_FILE | \
    awk '{print $1, $2, $3}' | \
    sort | uniq -c | sort -rn | head -20

# 2. 統(tǒng)計(jì)HTTP狀態(tài)碼（針對(duì)Web日志）
if echo "$LOG_FILE" | grep -q -E "(access|nginx|apache)"; then
    echo -e "\n2. HTTP狀態(tài)碼分布:"
    awk '{print $9}' $LOG_FILE | sort | uniq -c | sort -rn
fi

# 3. 查找訪問頻率高的IP
echo -e "\n3. 高頻訪問IP TOP 10:"
awk '{print $1}' $LOG_FILE | sort | uniq -c | sort -rn | head -10

# 4. 查找可能攻擊的URL模式
echo -e "\n4. 可疑請(qǐng)求模式:"
grep -E "(\.\./|select.*from|union.*select|eval\(|base64_decode|shell_exec)" $LOG_FILE | head -10

# 5. 按時(shí)間統(tǒng)計(jì)請(qǐng)求量
echo -e "\n5. 請(qǐng)求量時(shí)間分布:"
if [ -f "$LOG_FILE" ]; then
    awk -F'[ :]' '{print $2":"$3}' $LOG_FILE | sort | uniq -c | tail -24
fi

# 6. 響應(yīng)時(shí)間分析（如果有響應(yīng)時(shí)間字段）
echo -e "\n6. 慢請(qǐng)求統(tǒng)計(jì):"
grep -o 'rt=[0-9]*\.[0-9]*' $LOG_FILE 2>/dev/null | \
    sed 's/rt=//' | \
    awk '{if($1>1) print $1}' | \
    sort -n | \
    awk 'BEGIN{count=0;sum=0} {count++;sum+=$1} END{if(count>0) print "平均響應(yīng)時(shí)間:" sum/count "秒"}'

#!/bin/bash
# 文件名：/opt/scripts/batch_operation.sh
# 功能：通過SSH批量在多臺(tái)服務(wù)器上執(zhí)行命令
# 配置：提前配置SSH免密登錄

SERVER_LIST=("server1" "server2" "server3" "192.168.1.100")
COMMAND="$1"
LOG_FILE="/var/log/batch_operation_$(date '+%Y%m%d').log"

if [ -z "$COMMAND" ]; then
    echo "用法: $0 '<要執(zhí)行的命令>'"
    echo "示例: $0 'df -h'"
    echo "示例: $0 'systemctl restart nginx'"
    exit 1
fi

echo "批量執(zhí)行命令: $COMMAND" | tee -a $LOG_FILE
echo "開始時(shí)間: $(date)" | tee -a $LOG_FILE
echo "======================================" | tee -a $LOG_FILE

for server in "${SERVER_LIST[@]}"; do
    echo -e "\n處理服務(wù)器: $server" | tee -a $LOG_FILE
    
    # 檢查服務(wù)器是否可達(dá)
    if ! ping -c 1 -W 2 $server &>/dev/null; then
        echo "? 服務(wù)器不可達(dá)" | tee -a $LOG_FILE
        continue
    fi
    
    # 執(zhí)行遠(yuǎn)程命令
    ssh -o ConnectTimeout=5 -o BatchMode=yes $server "$COMMAND" 2>&1 | \
        while IFS= read -r line; do
            echo "[$server] $line" | tee -a $LOG_FILE
        done
    
    # 檢查執(zhí)行結(jié)果
    if [ ${PIPESTATUS[0]} -eq 0 ]; then
        echo "? 執(zhí)行成功" | tee -a $LOG_FILE
    else
        echo "? 執(zhí)行失敗" | tee -a $LOG_FILE
    fi
done

echo -e "\n======================================" | tee -a $LOG_FILE
echo "完成時(shí)間: $(date)" | tee -a $LOG_FILE
echo "詳細(xì)日志: $LOG_FILE" | tee -a $LOG_FILE

#!/bin/bash
# 文件名：/opt/scripts/cert_check.sh
# 功能：檢查SSL證書過期時(shí)間

DOMAINS=(
    "example.com:443"
    "api.example.com:443"
    "blog.example.com:443"
)

DAYS_WARNING=30  # 提前30天警告

echo "SSL證書過期檢查 - $(date)"
echo "================================"

for domain_info in "${DOMAINS[@]}"; do
    domain=$(echo $domain_info | cut -d: -f1)
    port=$(echo $domain_info | cut -d: -f2)
    
    # 獲取證書信息
    cert_info=$(echo | openssl s_client -servername $domain -connect $domain:$port 2>/dev/null | openssl x509 -noout -dates 2>/dev/null)
    
    if [ -z "$cert_info" ]; then
        echo "? $domain - 無法獲取證書信息"
        continue
    fi
    
    # 提取過期時(shí)間
    not_after=$(echo "$cert_info" | grep 'notAfter' | cut -d= -f2)
    expire_date=$(date -d "$not_after" '+%Y-%m-%d')
    
    # 計(jì)算剩余天數(shù)
    expire_timestamp=$(date -d "$not_after" '+%s')
    current_timestamp=$(date '+%s')
    days_left=$(( (expire_timestamp - current_timestamp) / 86400 ))
    
    # 輸出結(jié)果
    if [ $days_left -lt 0 ]; then
        echo "? $domain - 證書已過期 $((0 - days_left)) 天! ($expire_date)"
    elif [ $days_left -lt $DAYS_WARNING ]; then
        echo "??  $domain - 證書將在 $days_left 天后過期 ($expire_date)"
    else
        echo "? $domain - 證書有效，剩余 $days_left 天 ($expire_date)"
    fi
done

#!/bin/bash
# 文件名：/opt/scripts/performance_snapshot.sh
# 功能：一次性收集系統(tǒng)性能快照

SNAPSHOT_DIR="/var/log/performance_snapshots"
mkdir -p $SNAPSHOT_DIR

SNAPSHOT_FILE="$SNAPSHOT_DIR/snapshot_$(date '+%Y%m%d_%H%M%S').txt"

echo "性能快照 - $(date)" > $SNAPSHOT_FILE
echo "================================" >> $SNAPSHOT_FILE

# 1. 系統(tǒng)基本信息
echo -e "\n1. 系統(tǒng)基本信息:" >> $SNAPSHOT_FILE
echo "主機(jī)名: $(hostname)" >> $SNAPSHOT_FILE
echo "內(nèi)核版本: $(uname -r)" >> $SNAPSHOT_FILE
echo "運(yùn)行時(shí)間: $(uptime -p)" >> $SNAPSHOT_FILE

# 2. CPU信息
echo -e "\n2. CPU信息:" >> $SNAPSHOT_FILE
echo "CPU型號(hào): $(grep 'model name' /proc/cpuinfo | head -1 | cut -d: -f2 | xargs)" >> $SNAPSHOT_FILE
echo "CPU核心數(shù): $(grep -c 'processor' /proc/cpuinfo)" >> $SNAPSHOT_FILE
echo "當(dāng)前負(fù)載: $(uptime | awk -F'load average:' '{print $2}')" >> $SNAPSHOT_FILE
echo "CPU使用率:" >> $SNAPSHOT_FILE
top -bn1 | grep "Cpu(s)" >> $SNAPSHOT_FILE

# 3. 內(nèi)存信息
echo -e "\n3. 內(nèi)存信息:" >> $SNAPSHOT_FILE
free -h >> $SNAPSHOT_FILE
echo -e "\n內(nèi)存占用前10進(jìn)程:" >> $SNAPSHOT_FILE
ps aux --sort=-%mem | head -11 >> $SNAPSHOT_FILE

# 4. 磁盤信息
echo -e "\n4. 磁盤信息:" >> $SNAPSHOT_FILE
df -h >> $SNAPSHOT_FILE
echo -e "\n磁盤IO統(tǒng)計(jì):" >> $SNAPSHOT_FILE
iostat -dx 1 2 2>/dev/null || echo "iostat未安裝" >> $SNAPSHOT_FILE

# 5. 網(wǎng)絡(luò)信息
echo -e "\n5. 網(wǎng)絡(luò)連接:" >> $SNAPSHOT_FILE
if command -v ss &> /dev/null; then
    ss -s >> $SNAPSHOT_FILE
else
    netstat -s | head -20 >> $SNAPSHOT_FILE
fi

echo -e "\n6. 進(jìn)程數(shù)統(tǒng)計(jì):" >> $SNAPSHOT_FILE
ps aux --no-headers | wc -l >> $SNAPSHOT_FILE

echo "快照已保存至: $SNAPSHOT_FILE"

# crontab -e 添加以下內(nèi)容

# 每5分鐘檢查系統(tǒng)狀態(tài)
*/5 * * * * /opt/scripts/system_monitor.sh > /dev/null 2>&1

# 每天凌晨2點(diǎn)執(zhí)行備份
0 2 * * * /opt/scripts/smart_backup.sh

# 每周日凌晨3點(diǎn)執(zhí)行全量備份
0 3 * * 0 /opt/scripts/mysql_backup.sh

# 每天凌晨4點(diǎn)清理日志
0 4 * * * find /var/log -name "*.log" -mtime +7 -delete

# 每小時(shí)檢查證書
0 * * * * /opt/scripts/cert_check.sh | mail -s "證書檢查報(bào)告" admin@example.com

# 每月1號(hào)凌晨執(zhí)行安全審計(jì)
0 0 1 * * /opt/scripts/security_audit.sh

# 1. 創(chuàng)建腳本目錄
sudo mkdir -p /opt/scripts

# 2. 復(fù)制腳本并設(shè)置權(quán)限
sudo cp *.sh /opt/scripts/
sudo chmod +x /opt/scripts/*.sh

# 3. 創(chuàng)建日志目錄
sudo mkdir -p /var/log/scripts

# 語法檢查
bash -n script.sh

# 詳細(xì)執(zhí)行（調(diào)試模式）
bash -x script.sh

# 記錄執(zhí)行日志
./script.sh 2>&1 | tee /var/log/script_exec.log