- 论坛徽章:
- 0
|
Solaris_build_document文档翻译认领开始
每夜从cron运行脚本
# EDITOR=vi ;export EDITOR
# crontab –e
0 0 * * * /etc/security/newauditlog.sh
注意：用praudit命令把审计数据成ASCII格式。
# cd /var/audit
# praudit logfile
*摘自Solaris安全指南
安装监控脚本
root登录通知脚本
目的：监控通过su命令或者直接在控制台的root登录，用email通知。
隶属：/var/adm/sulog
/etc/aliases –status (e-mail addresses of administrators)
# vi /opt/admin/scripts/rtlgn.sh
#!/bin/ksh
PATH=/usr/sbin:/usr/bin:/usr/ucb:/bin
SRVNM=`uname –n`
DATE=`date ‘+%m/%d’`
DAY=`date ‘+%d’`
HOUR=`date ‘+%H’`
MONTH=`date ‘+%m’`
MIN=`date ‘+%M’`
LOGDIR=/var/adm/log/rtlgn
DATFILE=$LOGDIR/rtlgn.dat
if [ ! –d $LOGDIR ] ; then
mkdir –p $LOGDIR
touch $DATFILE
fi
# 每天清空日志文件
if [ $HOUR –eq “00” ]; then
if [ $MIN –lt “15” ]; then
>;$DATFILE
fi
fi
# 下一个变量可能设为多个地址（如 jsmith@yahoo.com,jsmith@hotmail.com）
MAILADD=monitor
# 检查远程的root用户登录，（不应该发生远程登录）
# 检查最近root控制台登陆 决定现在是否法通知
if [ `grep –c “$DATE $HOUR CONSOLE” $DATFILE` -eq 0 ]
then
if [ `last root console | grep –c “$MONTH $DAY $HOUR” ` -gt 0 ]; then
mail $MAILADD <<EOF
From 0
To: $MAILADD
Subject: Root Console Login $SRVNM
A root console login has occurred:
`last root console | grep “$MONTH $DAY $HOUR”`
EOF
#确保每小时通知一次
print “$DATE $HOUR CONSOLE” >;>; $DATFILE
fi
fi
#检查最近su成root
#确定这个小时通知是否发出
if [ `grep –c “$DATE $HOUR SU” $DATFILE ` -lt 1 ]
then
if [ `grep “$DATE $HOUR” /var/adm/sulog |grep –v root- |grep root |grep –c “+” ` -gt 0 ]
then
mail $MAILADD <<EOF
From: $0
To: $MAILADD
Subject: Root Access on $SRVNM
The following root login has occurred:
` grep “$DATE $HOUR” /var/adm/sulog | grep root | grep “+”`
EOF
#确保每个小时发出一次通知
print “$DATE $HOUR SU” >;>; $DATFILE
fi
fi
exit 0
# chmod 700 /opt/admin/scripts/rtlgn.sh
系统引导通知脚本(S99notify)
目的：当服务器启动时发出通知。
隶属：无
/etc/aliases – monitor (管理员的邮件和寻呼机)
# vi /etc/rc2.d/S99notify
#!/bin/ksh
PATH=/usr/sbin:/usr/bin
SRVNM=`uname –n`
# 下面的变量能够设多个邮件地址
MAILADD=monitor
Mail $MAILADD <<EOF
From: $0
To: MAILADD
Subject: Boot of $SRVNM
$SRVNM has booted up
If this news to you,please investigate.
`date`
EOF
Exit 0
# chmod 700 /etc/rc2.d/S99notify
安装LogSentry
LogSentry解析/var/adm/message并对攻击和入侵类文件发通知。定制忽略文件用以减少积极的失效。每天从cron执行发送报告并给管理员发邮件通知。让人感觉在单个服务器上集中logsentry并运行logsentry。参见：http://www.psionic.com/products/logsentry.html
文件系统监视脚本（mon_fs.sh）
目的：监视文件系统的尺寸，通过邮件发送通知。
隶属：mon_fs.dat-包括被警告前要监视那些文件系统、它们的容量有多大。
/etc/aliases-status(管理员的邮件地址)
# vi /opt/admin/scripts/mon_fs.sh
#!/bin/ksh
#该脚本存放的目录
ADMINIR=/opt/admin/scripts
MAILADD=monitor
# 服务器的名称
SRVNM=`uname –n`
while read –r FS MAXCAP
do
CAPACITY=`df –k $FS | grep –v avail | awk {‘print $5’} | awk –F% {‘print $1’}`
If test $CAPACITY –gt $MAXCAP; then
From: $0
To: $MAILADD
Subject: File System on $SRVNM
$FS is at $CAPACITY% capacity on %SRVNM (Threshold is $MAXCAP%).
`date`
EOF
fi
done < $ADMINDIR/mon_fs.dat
exit 0
# vi /opt/admin/scripts/mon_fs.dat
/ 90
/var 90
/opt 90
# chmod 600 /opt/admin/scripts/mon_fs.dat
# chmod 700 /opt/admin/scrits/mon_fs.sh
进程监控脚本（mon_procs.sh）
目的：确保进程在运行，通过邮件通知。
隶属：mon_procs.dat-包括进程名。
/etc/aliases-status(管理员的邮件地址)
# vi /opt/admin/scripts/mon_procs.sh
#!/bin/ksh
ADMINDIR=/opt/admin/scripts
MAILADD=monitor
SRVNM=`uname –n`
while read PROG
wo
ANSWER=`ps –e –o comm | grep $PROG`
if test “$ANSWER” = “$PROG”; then
sleep 1
else
mail $MAILADD <<EOF
From: $0
To: $MAILADD
Subject: Missing process on $SRVNM
Checking $PROG on $SRVNM... not found!
EOF
fi
done < $ADMIDIR/mon_procs.dat
exit 0
# vi /opt/admin/scripts/mon_proc.dat
/usr/sbin/syslog
# chmod 700 /opt/admin/scripts/mon_procs.sh
# chmod 600 /opt/admin/scripts/mon_procs.dat
服务器监控脚本(mon_srv.sh)
目的：确保服务器能够响应ping，通过邮件通知。
隶属：mon_srv.dat-包括IP地址、监视者邮件地址、服务器名。
/etc/aliases-status(管理员的邮件地址)
# vi /opt/admin/scripts/mon_srv.sh
#!/bin/ksh
ADMINDIR=monitor
while read –r IP SRVNM
do
if test `/usr/sbin/ping $IP | grep –c “is alive”` -eq 0; then
#wait 5 minutes before checking again
sleep 300
if test `/usr/sbin/ping $IP | grep –c “is alive”` -eq 0 ; then
mail $MAILADD <<EOF
From: $0
To: $MAILADD
Subject: $SRVNM Down
$SRVNM is noot responding.
EOF
fi
fi
done < $ADMINIR/mon_srv.dat
exit 0
# vi /opt/admin/scripts/mon_srv.dat
192.168.1.103 hostname
# chmod 700 /opt/admin/scripts/mon_srv.sh
# chmod 600 /opt/admin/scripts/mon_srv.dat
用户磁盘空间监控脚本（maildu.sh）
目的：当用户的主目录超过100MB时通知用户，给局域网用户发邮件。
隶属：~/.forward – 包括用户的局域网邮件地址。
# vi /opt/admin/scripts/maildu.sh
#!/bin/ksh
PATH=/usr/sbin:/usr/bin:/usr/ucb:/bin:.
HOMEDIR=/export/home
SRVNM=`uname –n`
#确保临时文件在退出前清理干净
trap ‘/bin/rm –fr $tmp; exit ‘ 0 1 2 3 15
WRKFILE=/tmp/prog$$
#检查用户使用的空间
cd $HOMEDIR
du –sk * | sort –nr >;>; $WRKFILE
#通知用户
while read –r MB NAME
do
if [ “$MB” –gt “102400” ] ; then
#通知root 用户
print “Mailing Disk Usage reminders out to:\n”
print “$NAME \t$MB KB\n”
if [ -f $HOMEDIR/$NAME/.forward ]; then
MAILADD=`cat $HOMEDIR/$NAME/.forward`
else
MAILADD=$NAME
fi
mail $MAILADD <<EOF
From: $0
To: $MAILADD
Subject: Disk Usage on $SRVNM
The automated disk usage utility indicates that you have $MB KB’s of
disk usage in your home directory on $SRVNM.You receive mail if you have more than 100MB
in your home directory. Please delete any excess files you have. Thank you.
UNIX System Administrators
EOF
fi
done < $WRKFILE
rm $WRKFILE
exit 0
# chmod 700 maildu.sh
性能监控脚本（mon_prf.sh）
目的：监视服务器的性能。使用vmstat iostat netstat 和其他性能察看命令，通过邮件通知用户。
隶属：/etc/aliases – status(管理员的邮件地址)
# vi /opt/admin/scripts/mon_prf.sh
#!/bin/ksh
PATH=$PATH:/usr/sbin:/usr/bin
SRVNM=`uname –n`
ADMINDIR=/opt/admin/scripts
DATDIR=/var/adm/log/mon_prf
if [ ! –d $DATDIR ] ; then
mkdir –p $DATDIR
fi
MAILADD=monitor
VMSTAT=`vmstat 1 2 | tail –l `
# CPU性能（vmstat –r column）
#当’r’或者运行队列栏目每CPU的进程达到3个以上，CPU的能力明显不足，一个进程在#得到CPU前在等待队列中的等待时间加长。这会降低吞吐量，增大交互相应的时间。
CPUPERF=`echo $VMSTAT | awk ‘{ print $1}`
if [ “$CPUPERF” –gt “3” ]; then
mail $MAILADD <<EOF
From: $0
To: $MAILADD
Subject: CPU Performance on $SRVNM
The vmstat tun queue column has exceeded 3 processes per CPU on $SRVNM.
There is insufficient CPU power for the load placed on the server.
EOF
fi
#CPU性能（vmstat – cpu id column）
#cpu id列指出哪个cpu在等待
CPUSTAT=`scho $VMSTAT | awk ‘{ print $22 }`
if [ “$CPUSTAT” –lt “10” ]; then
mail $MAILADD <<EOF
From: $0
To: $MAILADD
Subject: cpu Performance on $SRVNM
The vmstat cpu id column is less than 10 on $SRVNM.
The CPU is idle $CPUSTAT % of the time.
EOF
fi
#内存性能（vmstat –sr column）
#专家说当’sr’或扫描速度达到200以上，系统会以很高的速度扫描内存寻找空闲的页面。这指出活动的页面可能被进程窃取。过高的扫描速度会使系统比平常消耗更多的CPU资源。
MEMSTAT=`echo $VMSTAT | tail –l | awk ‘{ print $12 }`
if [ “$MEMSTAT” –gt “200” ]; then
mail $MAILADD <<EOF
From: $0
To: $MAILADD
Subject: Memory Performance on $SRVNM
According to vmstat,the scanrate on $SRVNM is $MEMSTAT.
This indicates that there is no enough memory the server’s current load.
EOF
fi
# TCP 连接
TCPCON=`netstat –aP tcp | tail +39 | wc –l`
if [ “$TCPCON” –gt “900” ]; then
mail $MAILADD <<EOF
From: $0
To: $MAILADD
Subject: TCP Connections on $SRVNM
According to netstat –a,there are currently %TCPCON TCP Connections on
$SRVNM.This may or may not be cause for soncern.
EOF
fi
# NIC 输入错误
# netstat –i
# NETIDAT=`netstat –i | grep hme0`
#NICIE=`echo $NETIDAT | awk {‘print $6’}`
if [ “$NICIE” –gt “10” ]； then
mail $MAILADD <<EOF
From: $0
To: $MAILADD
Subject: NIC Input Errors on $SRVNM
According to netstat –i, there are currently $NICIE input errors on $SRVNM hme0 on NIC
EOF
fi
# NIC 输出错误
#NICOE=`echo $NETIDAT | awk {‘print $8’}`
if [ “$NICOE” –gt “10” ]； then
mail $MAILADD <<EOF
From: $0
To: $MAILADD
Subject: NIC Input Errors on $SRVNM
According to netstat –i, there are currently $NICOE output errors on $SRVNM hme0 on NIC
EOF
fi
#iostat
#磁盘性能
#生成iostat数据文件
# DATFILE=$DATDIR/iostat.dat
# cp $DATFILE $DATFILE.old
# cp /dev/null $DATFILE
#检查 iostat util 列
# IODAT=`iostat –Dl 20 –n | tail –l`
# DSKSTAT=`echo $IOSTAT | awk ‘{ print $3,$6,$9,$12,$15,$18,$21,$24,$27,$30,$33,$39,$42,$45,$48,$51,$54,$57,$60 }`
# 需要编辑下一行解决这个问题
# echo $DSKSTAT >;>; $DATFILE
# cat iostat.dat | awk {‘ print $2’}
while read –r
do
if [ “$REPLY” –gt “3” ]; then
mail $MAILADD <EOF
From: $0
To: $MAILADD
Subject: Disk Perfoemance on $SRVNM
According to iostat,the disk utilization on $SRVNM is greater than 3 on
the server’s hard disks.The indicates that the disk is being heavily used.
EOF
fi
Done <$DATFILE
#netstat
# CPU 数据
# mpstat
# swap -l
# /tmp (不作为交换空间)
# du –sk /tmp
exit 0
# chmod 700 /opt/admin/scripts/mon_prf.sh |
|
免费注册
发表于 2003-07-06 16:33
发表于 2003-07-07 11:49
perator@domain.com
:1:1::/usr/sbin/noshell