客戶這裏，有很多linux主機，都是centos7的，我們需要定期每天對linux主機進行巡檢，然後把巡檢結果集中保存，方便對主機狀態檢查。
爲了巡檢工作需要，需要在linux主機上編寫巡檢腳本，配置rsync客戶端。、
linux巡檢腳本
我收集了一個巡檢腳本，如下所示：
#!bin/bash
#主機信息每日巡檢
IPADDR=$(ifconfig eth0 | grep '\<inet\>' | awk '{print $2}')
#環境變量PATH沒設好，在cron裏執行時有很多命令會找不到
export PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin
source /etc/profile
[ $(id -u) -gt 0 ] && echo "請用root用戶執行此腳本！" && exit 1
centosVersion=$(awk '{print $(NF-1)}' /etc/redhat-release)
VERSION="2018.08.28"
#日誌相關
LOGPATH="$PROGPATH/var/log/HostDailyCheck"
[ -e $LOGPATH ] || mkdir $LOGPATH
RESULTFILE="$LOGPATH/HostDailyCheck-$IPADDR-`date +%Y%m%d`.txt"
#定義報表的全局變量
report_DateTime="" #日期 ok
report_Hostname="" #主機名 ok
report_OSRelease="" #發行版本 ok
report_Kernel="" #內核 ok
report_Language="" #語言/編碼 ok
report_LastReboot="" #最近啓動時間 ok
report_Uptime="" #運行時間（天） ok
report_CPUs="" #CPU數量 ok
report_CPUType="" #CPU類型 ok
report_Arch="" #CPU架構 ok
report_MemTotal="" #內存總容量(MB) ok
report_MemFree="" #內存剩餘(MB) ok
report_MemUsedPercent="" #內存使用率% ok
report_DiskTotal="" #硬盤總容量(GB) ok
report_DiskFree="" #硬盤剩餘(GB) ok
report_DiskUsedPercent="" #硬盤使用率% ok
report_InodeTotal="" #Inode總量 ok
report_InodeFree="" #Inode剩餘 ok
report_InodeUsedPercent="" #Inode使用率 ok
report_IP="" #IP地址 ok
report_MAC="" #MAC地址 ok
report_Gateway="" #默認網關 ok
report_DNS="" #DNS ok
report_Listen="" #監聽 ok
report_Selinux="" #Selinux ok
report_Firewall="" #防火牆 ok
report_USERs="" #用戶 ok
report_USEREmptyPassword="" #空密碼用戶 ok
report_USERTheSameUID="" #相同ID的用戶 ok
report_PasswordExpiry="" #密碼過期（天） ok
report_RootUser="" #root用戶 ok
report_Sudoers="" #sudo授權 ok
report_SSHAuthorized="" #SSH信任主機 ok
report_SSHDProtocolVersion="" #SSH協議版本 ok
report_SSHDPermitRootLogin="" #允許root遠程登錄 ok
report_DefunctProsess="" #殭屍進程數量 ok
report_SelfInitiatedService="" #自啓動服務數量 ok
report_SelfInitiatedProgram="" #自啓動程序數量 ok
report_RuningService="" #運行中服務數 ok
report_Crontab="" #計劃任務數 ok
report_Syslog="" #日誌服務 ok
report_SNMP="" #SNMP OK
report_NTP="" #NTP ok
report_JDK="" #JDK版本 ok
function version(){
echo ""
echo ""
echo "系統巡檢腳本：Version $VERSION"
}
function getCpuStatus(){
echo ""
echo ""
echo "############################ CPU檢查 #############################"
Physical_CPUs=$(grep "physical id" /proc/cpuinfo| sort | uniq | wc -l)
Virt_CPUs=$(grep "processor" /proc/cpuinfo | wc -l)
CPU_Kernels=$(grep "cores" /proc/cpuinfo|uniq| awk -F ': ' '{print $2}')
CPU_Type=$(grep "model name" /proc/cpuinfo | awk -F ': ' '{print $2}' | sort | uniq)
CPU_Arch=$(uname -m)
echo "物理CPU個數:$Physical_CPUs"
echo "邏輯CPU個數:$Virt_CPUs"
echo "每CPU核心數:$CPU_Kernels"
echo " CPU型號:$CPU_Type"
echo " CPU架構:$CPU_Arch"
#報表信息
report_CPUs=$Virt_CPUs #CPU數量
report_CPUType=$CPU_Type #CPU類型
report_Arch=$CPU_Arch #CPU架構
}
function getMemStatus(){
echo ""
echo ""
echo "############################ 內存檢查 ############################"
if [[ $centosVersion < 7 ]];then
free -mo
else
free -h
fi
#報表信息
MemTotal=$(grep MemTotal /proc/meminfo| awk '{print $2}') #KB
MemFree=$(grep MemFree /proc/meminfo| awk '{print $2}') #KB
let MemUsed=MemTotal-MemFree
MemPercent=$(awk "BEGIN {if($MemTotal==0){printf 100}else{printf \"%.2f\",$MemUsed*100/$MemTotal}}")
report_MemTotal="$((MemTotal/1024))""MB" #內存總容量(MB)
report_MemFree="$((MemFree/1024))""MB" #內存剩餘(MB)
report_MemUsedPercent="$(awk "BEGIN {if($MemTotal==0){printf 100}else{printf \"%.2f\",$MemUsed*100/$MemTotal}}")""%" #內存使用率%
}
function getDiskStatus(){
echo ""
echo ""
echo "############################ 磁盤檢查 ############################"
df -hiP | sed 's/Mounted on/Mounted/'> /tmp/inode
df -hTP | sed 's/Mounted on/Mounted/'> /tmp/disk
join /tmp/disk /tmp/inode | awk '{print $1,$2,"|",$3,$4,$5,$6,"|",$8,$9,$10,$11,"|",$12}'| column -t
#報表信息
diskdata=$(df -TP | sed '1d' | awk '$2!="tmpfs"{print}') #KB
disktotal=$(echo "$diskdata" | awk '{total+=$3}END{print total}') #KB
diskused=$(echo "$diskdata" | awk '{total+=$4}END{print total}') #KB
diskfree=$((disktotal-diskused)) #KB
diskusedpercent=$(echo $disktotal $diskused | awk '{if($1==0){printf 100}else{printf "%.2f",$2*100/$1}}')
inodedata=$(df -iTP | sed '1d' | awk '$2!="tmpfs"{print}')
inodetotal=$(echo "$inodedata" | awk '{total+=$3}END{print total}')
inodeused=$(echo "$inodedata" | awk '{total+=$4}END{print total}')
inodefree=$((inodetotal-inodeused))
inodeusedpercent=$(echo $inodetotal $inodeused | awk '{if($1==0){printf 100}else{printf "%.2f",$2*100/$1}}')
report_DiskTotal=$((disktotal/1024/1024))"GB" #硬盤總容量(GB)
report_DiskFree=$((diskfree/1024/1024))"GB" #硬盤剩餘(GB)
report_DiskUsedPercent="$diskusedpercent""%" #硬盤使用率%
report_InodeTotal=$((inodetotal/1000))"K" #Inode總量
report_InodeFree=$((inodefree/1000))"K" #Inode剩餘
report_InodeUsedPercent="$inodeusedpercent""%" #Inode使用率%
}
function getSystemStatus(){
echo ""
echo ""
echo "############################ 系統檢查 ############################"
if [ -e /etc/sysconfig/i18n ];then
default_LANG="$(grep "LANG=" /etc/sysconfig/i18n | grep -v "^#" | awk -F '"' '{print $2}')"
else
default_LANG=$LANG
fi
export LANG="en_US.UTF-8"
Release=$(cat /etc/redhat-release 2>/dev/null)
Kernel=$(uname -r)
OS=$(uname -o)
Hostname=$(uname -n)
SELinux=$(/usr/sbin/sestatus | grep "SELinux status: " | awk '{print $3}')
LastReboot=$(who -b | awk '{print $3,$4}')
uptime=$(uptime | sed 's/.*up \([^,]*\), .*/\1/')
echo " 系統：$OS"
echo " 發行版本：$Release"
echo " 內核：$Kernel"
echo " 主機名：$Hostname"
echo " SELinux：$SELinux"
echo "語言/編碼：$default_LANG"
echo " 當前時間：$(date +'%F %T')"
echo " 最後啓動：$LastReboot"
echo " 運行時間：$uptime"
#報表信息
report_DateTime=$(date +"%F %T") #日期
report_Hostname="$Hostname" #主機名
report_OSRelease="$Release" #發行版本
report_Kernel="$Kernel" #內核
report_Language="$default_LANG" #語言/編碼
report_LastReboot="$LastReboot" #最近啓動時間
report_Uptime="$uptime" #運行時間（天）
report_Selinux="$SELinux"
export LANG="$default_LANG"
}
function getServiceStatus(){
echo ""
echo ""
echo "############################ 服務檢查 ############################"
echo ""
if [[ $centosVersion > 7 ]];then
conf=$(systemctl list-unit-files --type=service --state=enabled --no-pager | grep "enabled")
process=$(systemctl list-units --type=service --state=running --no-pager | grep ".service")
#報表信息
report_SelfInitiatedService="$(echo "$conf" | wc -l)" #自啓動服務數量
report_RuningService="$(echo "$process" | wc -l)" #運行中服務數量
else
conf=$(/sbin/chkconfig | grep -E ":on|:啓用")
process=$(/sbin/service --status-all 2>/dev/null | grep -E "is running|正在運行")
#報表信息
report_SelfInitiatedService="$(echo "$conf" | wc -l)" #自啓動服務數量
report_RuningService="$(echo "$process" | wc -l)" #運行中服務數量
fi
echo "服務配置"
echo "--------"
echo "$conf" | column -t
echo ""
echo "正在運行的服務"
echo "--------------"
echo "$process"
}
function getAutoStartStatus(){
echo ""
echo ""
echo "############################ 自啓動檢查 ##########################"
conf=$(grep -v "^#" /etc/rc.d/rc.local| sed '/^$/d')
echo "$conf"
#報表信息
report_SelfInitiatedProgram="$(echo $conf | wc -l)" #自啓動程序數量
}
function getLoginStatus(){
echo ""
echo ""
echo "############################ 登錄檢查 ############################"
last | head
}
function getNetworkStatus(){
echo ""
echo ""
echo "############################ 網絡檢查 ############################"
if [[ $centosVersion < 7 ]];then
/sbin/ifconfig -a | grep -v packets | grep -v collisions | grep -v inet6
else
#ip a
for i in $(ip link | grep BROADCAST | awk -F: '{print $2}');do ip add show $i | grep -E "BROADCAST|global"| awk '{print $2}' | tr '\n' ' ' ;echo "" ;done
fi
GATEWAY=$(ip route | grep default | awk '{print $3}')
DNS=$(grep nameserver /etc/resolv.conf| grep -v "#" | awk '{print $2}' | tr '\n' ',' | sed 's/,$//')
echo ""
echo "網關：$GATEWAY "
echo " DNS：$DNS"
#報表信息
IP=$(ip -f inet addr | grep -v 127.0.0.1 | grep inet | awk '{print $NF,$2}' | tr '\n' ',' | sed 's/,$//')
MAC=$(ip link | grep -v "LOOPBACK\|loopback" | awk '{print $2}' | sed 'N;s/\n//' | tr '\n' ',' | sed 's/,$//')
report_IP="$IP" #IP地址
report_MAC=$MAC #MAC地址
report_Gateway="$GATEWAY" #默認網關
report_DNS="$DNS" #DNS
}
function getListenStatus(){
echo ""
echo ""
echo "############################ 監聽檢查 ############################"
TCPListen=$(ss -ntul | column -t)
echo "$TCPListen"
#報表信息
report_Listen="$(echo "$TCPListen"| sed '1d' | awk '/tcp/ {print $5}' | awk -F: '{print $NF}' | sort | uniq | wc -l)"
}
function getCronStatus(){
echo ""
echo ""
echo "############################ 計劃任務檢查 ########################"
Crontab=0
for shell in $(grep -v "/sbin/nologin" /etc/shells);do
for user in $(grep "$shell" /etc/passwd| awk -F: '{print $1}');do
crontab -l -u $user >/dev/null 2>&1
status=$?
if [ $status -eq 0 ];then
echo "$user"
echo "--------"
crontab -l -u $user
let Crontab=Crontab+$(crontab -l -u $user | wc -l)
echo ""
fi
done
done
#計劃任務
find /etc/cron* -type f | xargs -i ls -l {} | column -t
let Crontab=Crontab+$(find /etc/cron* -type f | wc -l)
#報表信息
report_Crontab="$Crontab" #計劃任務數
}
function getHowLongAgo(){
# 計算一個時間戳離現在有多久了
datetime="$*"
[ -z "$datetime" ] && echo "錯誤的參數：getHowLongAgo() $*"
Timestamp=$(date +%s -d "$datetime") #轉化爲時間戳
Now_Timestamp=$(date +%s)
Difference_Timestamp=$(($Now_Timestamp-$Timestamp))
days=0;hours=0;minutes=0;
sec_in_day=$((60*60*24));
sec_in_hour=$((60*60));
sec_in_minute=60
while (( $(($Difference_Timestamp-$sec_in_day)) > 1 ))
do
let Difference_Timestamp=Difference_Timestamp-sec_in_day
let days++
done
while (( $(($Difference_Timestamp-$sec_in_hour)) > 1 ))
do
let Difference_Timestamp=Difference_Timestamp-sec_in_hour
let hours++
done
echo "$days 天 $hours 小時前"
}
function getUserLastLogin(){
# 獲取用戶最近一次登錄的時間，含年份
# 很遺憾last命令不支持顯示年份，只有"last -t YYYYMMDDHHMMSS"表示某個時間之間的登錄，我
# 們只能用最笨的方法了，對比今天之前和今年元旦之前（或者去年之前和前年之前……）某個用戶
# 登錄次數，如果登錄統計次數有變化，則說明最近一次登錄是今年。
username=$1
: ${username:="`whoami`"}
thisYear=$(date +%Y)
oldesYear=$(last | tail -n1 | awk '{print $NF}')
while(( $thisYear >= $oldesYear));do
loginBeforeToday=$(last $username | grep $username | wc -l)
loginBeforeNewYearsDayOfThisYear=$(last $username -t $thisYear"0101000000" | grep $username | wc -l)
if [ $loginBeforeToday -eq 0 ];then
echo "從未登錄過"
break
elif [ $loginBeforeToday -gt $loginBeforeNewYearsDayOfThisYear ];then
lastDateTime=$(last -i $username | head -n1 | awk '{for(i=4;i<(NF-2);i++)printf"%s ",$i}')" $thisYear" #格式如: Sat Nov 2 20:33 2015
lastDateTime=$(date "+%Y-%m-%d %H:%M:%S" -d "$lastDateTime")
echo "$lastDateTime"
break
else
thisYear=$((thisYear-1))
fi
done
}
function getUserStatus(){
echo ""
echo ""
echo "############################ 用戶檢查 ############################"
#/etc/passwd 最後修改時間
pwdfile="$(cat /etc/passwd)"
Modify=$(stat /etc/passwd | grep Modify | tr '.' ' ' | awk '{print $2,$3}')
echo "/etc/passwd 最後修改時間：$Modify ($(getHowLongAgo $Modify))"
echo ""
echo "特權用戶"
echo "--------"
RootUser=""
for user in $(echo "$pwdfile" | awk -F: '{print $1}');do
if [ $(id -u $user) -eq 0 ];then
echo "$user"
RootUser="$RootUser,$user"
fi
done
echo ""
echo "用戶列表"
echo "--------"
USERs=0
echo "$(
echo "用戶名 UID GID HOME SHELL 最後一次登錄"
for shell in $(grep -v "/sbin/nologin" /etc/shells);do
for username in $(grep "$shell" /etc/passwd| awk -F: '{print $1}');do
userLastLogin="$(getUserLastLogin $username)"
echo "$pwdfile" | grep -w "$username" |grep -w "$shell"| awk -F: -v lastlogin="$(echo "$userLastLogin" | tr ' ' '_')" '{print $1,$3,$4,$6,$7,lastlogin}'
done
let USERs=USERs+$(echo "$pwdfile" | grep "$shell"| wc -l)
done
)" | column -t
echo ""
echo "空密碼用戶"
echo "----------"
USEREmptyPassword=""
for shell in $(grep -v "/sbin/nologin" /etc/shells);do
for user in $(echo "$pwdfile" | grep "$shell" | cut -d: -f1);do
r=$(awk -F: '$2=="!!"{print $1}' /etc/shadow | grep -w $user)
if [ ! -z $r ];then
echo $r
USEREmptyPassword="$USEREmptyPassword,"$r
fi
done
done
echo ""
echo "相同ID的用戶"
echo "------------"
USERTheSameUID=""
UIDs=$(cut -d: -f3 /etc/passwd | sort | uniq -c | awk '$1>1{print $2}')
for uid in $UIDs;do
echo -n "$uid";
USERTheSameUID="$uid"
r=$(awk -F: 'ORS="";$3=='"$uid"'{print ":",$1}' /etc/passwd)
echo "$r"
echo ""
USERTheSameUID="$USERTheSameUID $r,"
done
#報表信息
report_USERs="$USERs" #用戶
report_USEREmptyPassword=$(echo $USEREmptyPassword | sed 's/^,//')
report_USERTheSameUID=$(echo $USERTheSameUID | sed 's/,$//')
report_RootUser=$(echo $RootUser | sed 's/^,//') #特權用戶
}
function getPasswordStatus {
echo ""
echo ""
echo "############################ 密碼檢查 ############################"
pwdfile="$(cat /etc/passwd)"
echo ""
echo "密碼過期檢查"
echo "------------"
result=""
for shell in $(grep -v "/sbin/nologin" /etc/shells);do
for user in $(echo "$pwdfile" | grep "$shell" | cut -d: -f1);do
get_expiry_date=$(/usr/bin/chage -l $user | grep 'Password expires' | cut -d: -f2)
if [[ $get_expiry_date = ' never' || $get_expiry_date = 'never' ]];then
printf "%-15s 永不過期\n" $user
result="$result,$user:never"
else
password_expiry_date=$(date -d "$get_expiry_date" "+%s")
current_date=$(date "+%s")
diff=$(($password_expiry_date-$current_date))
let DAYS=$(($diff/(60*60*24)))
printf "%-15s %s天后過期\n" $user $DAYS
result="$result,$user:$DAYS days"
fi
done
done
report_PasswordExpiry=$(echo $result | sed 's/^,//')
echo ""
echo "密碼策略檢查"
echo "------------"
grep -v "#" /etc/login.defs | grep -E "PASS_MAX_DAYS|PASS_MIN_DAYS|PASS_MIN_LEN|PASS_WARN_AGE"
}
function getSudoersStatus(){
echo ""
echo ""
echo "############################ Sudoers檢查 #########################"
conf=$(grep -v "^#" /etc/sudoers| grep -v "^Defaults" | sed '/^$/d')
echo "$conf"
echo ""
#報表信息
report_Sudoers="$(echo $conf | wc -l)"
}
function getInstalledStatus(){
echo ""
echo ""
echo "############################ 軟件檢查 ############################"
rpm -qa --last | head | column -t
}
function getProcessStatus(){
echo ""
echo ""
echo "############################ 進程檢查 ############################"
if [ $(ps -ef | grep defunct | grep -v grep | wc -l) -ge 1 ];then
echo ""
echo "殭屍進程";
echo "--------"
ps -ef | head -n1
ps -ef | grep defunct | grep -v grep
fi
echo ""
echo "內存佔用TOP10"
echo "-------------"
echo -e "PID %MEM RSS COMMAND
$(ps aux | awk '{print $2, $4, $6, $11}' | sort -k3rn | head -n 10 )"| column -t
echo ""
echo "CPU佔用TOP10"
echo "------------"
top b -n1 | head -17 | tail -11
#報表信息
report_DefunctProsess="$(ps -ef | grep defunct | grep -v grep|wc -l)"
}
function getJDKStatus(){
echo ""
echo ""
echo "############################ JDK檢查 #############################"
java -version 2>/dev/null
if [ $? -eq 0 ];then
java -version 2>&1
fi
echo "JAVA_HOME=\"$JAVA_HOME\""
#報表信息
report_JDK="$(java -version 2>&1 | grep version | awk '{print $1,$3}' | tr -d '"')"
}
function getSyslogStatus(){
echo ""
echo ""
echo "############################ syslog檢查 ##########################"
echo "服務狀態：$(getState rsyslog)"
echo ""
echo "/etc/rsyslog.conf"
echo "-----------------"
cat /etc/rsyslog.conf 2>/dev/null | grep -v "^#" | grep -v "^\\$" | sed '/^$/d' | column -t
#報表信息
report_Syslog="$(getState rsyslog)"
}
function getFirewallStatus(){
echo ""
echo ""
echo "############################ 防火牆檢查 ##########################"
#防火牆狀態，策略等
if [[ $centosVersion < 7 ]];then
/etc/init.d/iptables status >/dev/null 2>&1
status=$?
if [ $status -eq 0 ];then
s="active"
elif [ $status -eq 3 ];then
s="inactive"
elif [ $status -eq 4 ];then
s="permission denied"
else
s="unknown"
fi
else
s="$(getState iptables)"
fi
echo "iptables: $s"
echo ""
echo "/etc/sysconfig/iptables"
echo "-----------------------"
cat /etc/sysconfig/iptables 2>/dev/null
#報表信息
report_Firewall="$s"
}
function getSNMPStatus(){
#SNMP服務狀態，配置等
echo ""
echo ""
echo "############################ SNMP檢查 ############################"
status="$(getState snmpd)"
echo "服務狀態：$status"
echo ""
if [ -e /etc/snmp/snmpd.conf ];then
echo "/etc/snmp/snmpd.conf"
echo "--------------------"
cat /etc/snmp/snmpd.conf 2>/dev/null | grep -v "^#" | sed '/^$/d'
fi
#報表信息
report_SNMP="$(getState snmpd)"
}
function getState(){
if [[ $centosVersion < 7 ]];then
if [ -e "/etc/init.d/$1" ];then
if [ `/etc/init.d/$1 status 2>/dev/null | grep -E "is running|正在運行" | wc -l` -ge 1 ];then
r="active"
else
r="inactive"
fi
else
r="unknown"
fi
else
#CentOS 7+
r="$(systemctl is-active $1 2>&1)"
fi
echo "$r"
}
function getSSHStatus(){
#SSHD服務狀態，配置,受信任主機等
echo ""
echo ""
echo "############################ SSH檢查 #############################"
#檢查受信任主機
pwdfile="$(cat /etc/passwd)"
echo "服務狀態：$(getState sshd)"
Protocol_Version=$(cat /etc/ssh/sshd_config | grep Protocol | awk '{print $2}')
echo "SSH協議版本：$Protocol_Version"
echo ""
echo "信任主機"
echo "--------"
authorized=0
for user in $(echo "$pwdfile" | grep /bin/bash | awk -F: '{print $1}');do
authorize_file=$(echo "$pwdfile" | grep -w $user | awk -F: '{printf $6"/.ssh/authorized_keys"}')
authorized_host=$(cat $authorize_file 2>/dev/null | awk '{print $3}' | tr '\n' ',' | sed 's/,$//')
if [ ! -z $authorized_host ];then
echo "$user 授權 \"$authorized_host\" 無密碼訪問"
fi
let authorized=authorized+$(cat $authorize_file 2>/dev/null | awk '{print $3}'|wc -l)
done
echo ""
echo "是否允許ROOT遠程登錄"
echo "--------------------"
config=$(cat /etc/ssh/sshd_config | grep PermitRootLogin)
firstChar=${config:0:1}
if [ $firstChar == "#" ];then
PermitRootLogin="yes" #默認是允許ROOT遠程登錄的
else
PermitRootLogin=$(echo $config | awk '{print $2}')
fi
echo "PermitRootLogin $PermitRootLogin"
echo ""
echo "/etc/ssh/sshd_config"
echo "--------------------"
cat /etc/ssh/sshd_config | grep -v "^#" | sed '/^$/d'
#報表信息
report_SSHAuthorized="$authorized" #SSH信任主機
report_SSHDProtocolVersion="$Protocol_Version" #SSH協議版本
report_SSHDPermitRootLogin="$PermitRootLogin" #允許root遠程登錄
}
function getNTPStatus(){
#NTP服務狀態，當前時間，配置等
echo ""
echo ""
echo "############################ NTP檢查 #############################"
if [ -e /etc/ntp.conf ];then
echo "服務狀態：$(getState ntpd)"
echo ""
echo "/etc/ntp.conf"
echo "-------------"
cat /etc/ntp.conf 2>/dev/null | grep -v "^#" | sed '/^$/d'
fi
#報表信息
report_NTP="$(getState ntpd)"
}
function uploadHostDailyCheckReport(){
json="{
\"DateTime\":\"$report_DateTime\",
\"Hostname\":\"$report_Hostname\",
\"OSRelease\":\"$report_OSRelease\",
\"Kernel\":\"$report_Kernel\",
\"Language\":\"$report_Language\",
\"LastReboot\":\"$report_LastReboot\",
\"Uptime\":\"$report_Uptime\",
\"CPUs\":\"$report_CPUs\",
\"CPUType\":\"$report_CPUType\",
\"Arch\":\"$report_Arch\",
\"MemTotal\":\"$report_MemTotal\",
\"MemFree\":\"$report_MemFree\",
\"MemUsedPercent\":\"$report_MemUsedPercent\",
\"DiskTotal\":\"$report_DiskTotal\",
\"DiskFree\":\"$report_DiskFree\",
\"DiskUsedPercent\":\"$report_DiskUsedPercent\",
\"InodeTotal\":\"$report_InodeTotal\",
\"InodeFree\":\"$report_InodeFree\",
\"InodeUsedPercent\":\"$report_InodeUsedPercent\",
\"IP\":\"$report_IP\",
\"MAC\":\"$report_MAC\",
\"Gateway\":\"$report_Gateway\",
\"DNS\":\"$report_DNS\",
\"Listen\":\"$report_Listen\",
\"Selinux\":\"$report_Selinux\",
\"Firewall\":\"$report_Firewall\",
\"USERs\":\"$report_USERs\",
\"USEREmptyPassword\":\"$report_USEREmptyPassword\",
\"USERTheSameUID\":\"$report_USERTheSameUID\",
\"PasswordExpiry\":\"$report_PasswordExpiry\",
\"RootUser\":\"$report_RootUser\",
\"Sudoers\":\"$report_Sudoers\",
\"SSHAuthorized\":\"$report_SSHAuthorized\",
\"SSHDProtocolVersion\":\"$report_SSHDProtocolVersion\",
\"SSHDPermitRootLogin\":\"$report_SSHDPermitRootLogin\",
\"DefunctProsess\":\"$report_DefunctProsess\",
\"SelfInitiatedService\":\"$report_SelfInitiatedService\",
\"SelfInitiatedProgram\":\"$report_SelfInitiatedProgram\",
\"RuningService\":\"$report_RuningService\",
\"Crontab\":\"$report_Crontab\",
\"Syslog\":\"$report_Syslog\",
\"SNMP\":\"$report_SNMP\",
\"NTP\":\"$report_NTP\",
\"JDK\":\"$report_JDK\"
}"
#echo "$json"
curl -l -H "Content-type: application/json" -X POST -d "$json" "$uploadHostDailyCheckReportApi" 2>/dev/null
}
function check(){
version
getSystemStatus
getCpuStatus
getMemStatus
getDiskStatus
getNetworkStatus
getListenStatus
getProcessStatus
getServiceStatus
getAutoStartStatus
getLoginStatus
getCronStatus
getUserStatus
getPasswordStatus
getSudoersStatus
getJDKStatus
getFirewallStatus
getSSHStatus
getSyslogStatus
getSNMPStatus
getNTPStatus
getInstalledStatus
}
#執行檢查並保存檢查結果
check > $RESULTFILE
腳本會將巡檢結果保存到/var/log/HostDailyCheck/路徑下，以時間方式進行命名
可以查看巡檢內容
配置計劃任務，定期每日執行0 23 * * * bash /root/HostDailyCheck.sh
windows配置rsync服務器
因爲日常運維主機是windows，需要配置第三方軟件作爲服務器。如果是linux的話，配置rsync服務器會比較簡單。
cwRsyncServer服務端配置
下載地址：
https://www.backupassist.com/rsync/
安裝cwRsyncServer_4.2.0_Installer
下一步
下一步
這個安裝路徑，也是作爲rsync同步保存的路徑
Service account：rsync（新建的一個系統賬戶）
Type password：123456（密碼）
Confirm password：123456（密碼）
Install （安裝）
Close（關閉），安裝完成
開始-設置-控制面板-管理工具-服務
找到RsyncSever選項，雙擊打開
啓動類型：自動
點“啓動”
應用-確定
在window7中創建一個存放文件的目錄（rsync同步用的），我這裏創建的是G:\linux_server_log
右擊目錄，打開屬性——安全，把安裝rsyncd時，設置的帳號添加進來，並設置權限爲完全控制（我安裝rsyncd的時候，設置了帳號是rsync，密碼123456）：
修改配置文件：
打開G:\linux_server_log\ICW\rsyncd.conf
修改內容大致如下：
use chroot = false
strict modes = false
hosts allow = *
log file = rsyncd.log
# Module definitions
# Remember cygwin naming conventions : c:\work becomes /cygwin/c/work
#
[172.31.101.12]
path = /cygdrive/g/linux_server_log/172.31.101.12
read only = false
transfer logging = yes
auth users = rsync
secrets file = etc/rsyncd.secrets.txt
UID = 0
GID = 0
[172.31.101.24]
path = /cygdrive/g/linux_server_log/172.31.101.24
read only = false
transfer logging = yes
auth users = rsync
secrets file = etc/rsyncd.secrets.txt
UID = 0
GID = 0
[172.31.101.20]
path = /cygdrive/g/linux_server_log/172.31.101.20
read only = false
transfer logging = yes
auth users = rsync
secrets file = etc/rsyncd.secrets.txt
UID = 0
GID = 0
說明：
1、[172.31.101.12],[172.31.101.24]就是同步文件的目錄，我這裏以linux主機ip地址方式命名，方便區分，有多個客戶端需要進行rsync同步的話就要配置中添加多個配置
2、注意path路徑，path = /cygdrive/是固定的，不要改，後面連接的/g/linux_server_log/172.31.101.12，則是我們剛纔所建的目錄路徑，剛纔我是建在G盤的，g/linux_server_log/172.31.101.12
其他參數詳解：
read only = true #客戶端只讀
list = no#不允許列出文件
hosts allow=192.168.0.141 #允許連接IP，多個IP中間用英文狀態下逗號隔，不限制IP填寫*即可
auth users =rsync #允許連接的用戶名
secrets file = etc/rsyncd.secrets #存放用戶名密碼的認證文件路徑
建rsync同步帳號密碼文件：
進入：G:\linux_server_log\ICW\etc，創建文件：rsyncd.secrets，文件裏輸入 rsync:123456，rsync是同步帳號，123456是同步密碼
cwRsyncServer服務端安裝設置完成
Rsync客戶端配置
基於centos7 安裝
yum install rsync -y然後創建rsync客戶端同步密碼文件
vim /root/rysnc_passwd.txtch
設置密碼文件權限
chmod 600 /root/rysnc_passwd.txt測試rsync數據同步
rsync -vza --progress /var/log/HostDailyCheck --port=873 [email protected]::172.31.101.45 --password-file=/root/rysnc_passwd.txt
同步正常
關於rsync工具使用和命令參數，參考https://jaywcjlove.gitee.io/linux-command/c/rsync.html
然後我們編寫同步腳本
touch /root/rysncbak.sh
cat << EOF > /root/rysncbak.sh
#!/bin/sh
rsync -vza --progress /var/log/HostDailyCheck --port=873 [email protected]::172.31.101.45 --password-file=/root/rysnc_passwd.txt
EOF
chmod +x /root/rysncbak.sh腳本完成後，開啓加護任務，每天定時執行
crontab -e按照如下方式編寫計劃任務
至此每天都會定時運行主機巡檢腳本，同時會將巡檢結果同步
檢查巡檢日誌
完成所有的配置後，我們每天就可以收集到所有linux主機日誌狀態檢查
工作又輕鬆了