278 lines
7.7 KiB
Plaintext
278 lines
7.7 KiB
Plaintext
# 创建唯一的监控系统
|
|
cat > /usr/local/bin/cmdwatch << 'EOF'
|
|
#!/bin/bash
|
|
|
|
# 配置文件
|
|
CONFIG_DIR="/root/.cmdwatch"
|
|
LOG_FILE="$CONFIG_DIR/monitor.log"
|
|
PID_FILE="$CONFIG_DIR/pid"
|
|
LOCK_FILE="$CONFIG_DIR/lock"
|
|
|
|
# 初始化
|
|
init_system() {
|
|
mkdir -p "$CONFIG_DIR"
|
|
touch "$LOG_FILE"
|
|
}
|
|
|
|
# 获取客户端IP
|
|
get_client_ip() {
|
|
local ip="unknown"
|
|
[ -n "$SSH_CLIENT" ] && ip=$(echo "$SSH_CLIENT" | awk '{print $1}')
|
|
[ "$ip" = "unknown" ] && [ -n "$SSH_CONNECTION" ] && ip=$(echo "$SSH_CONNECTION" | awk '{print $1}')
|
|
echo "$ip"
|
|
}
|
|
|
|
# 检查是否运行中
|
|
is_running() {
|
|
if [ -f "$PID_FILE" ]; then
|
|
local pid=$(cat "$PID_FILE" 2>/dev/null)
|
|
if ps -p "$pid" >/dev/null 2>&1; then
|
|
return 0
|
|
else
|
|
rm -f "$PID_FILE"
|
|
fi
|
|
fi
|
|
return 1
|
|
}
|
|
|
|
# 文件锁
|
|
get_lock() {
|
|
exec 200>"$LOCK_FILE"
|
|
flock -n 200 && return 0
|
|
return 1
|
|
}
|
|
|
|
release_lock() {
|
|
flock -u 200
|
|
}
|
|
|
|
# 停止所有可能的监控进程
|
|
stop_all_monitors() {
|
|
echo "停止所有监控进程..."
|
|
# 停止当前系统
|
|
if [ -f "$PID_FILE" ]; then
|
|
local pid=$(cat "$PID_FILE" 2>/dev/null)
|
|
[ -n "$pid" ] && kill "$pid" 2>/dev/null
|
|
fi
|
|
|
|
# 停止其他可能运行的监控
|
|
pkill -f "cmd_monitor"
|
|
pkill -f "monitor.sh"
|
|
pkill -f "mt"
|
|
pkill -f "mon"
|
|
pkill -f "cmdwatch"
|
|
|
|
# 清理文件
|
|
rm -f "$PID_FILE"
|
|
rm -f "$LOCK_FILE"
|
|
sleep 1
|
|
}
|
|
|
|
# 主监控函数
|
|
start_monitoring() {
|
|
echo "启动命令监控..."
|
|
|
|
# 设置实时history
|
|
for user_dir in /home/* /root; do
|
|
[ -d "$user_dir" ] || continue
|
|
bashrc="$user_dir/.bashrc"
|
|
[ -f "$bashrc" ] || continue
|
|
if ! grep -q "PROMPT_COMMAND.*cmdwatch" "$bashrc" 2>/dev/null; then
|
|
echo 'export PROMPT_COMMAND="history -a; history -c; history -r #cmdwatch"' >> "$bashrc"
|
|
fi
|
|
done
|
|
|
|
# 启动监控进程
|
|
(
|
|
echo "=== 命令监控启动: $(date) ===" >> "$LOG_FILE"
|
|
declare -A file_sizes
|
|
|
|
# 初始化文件大小
|
|
for user_dir in /home/* /root; do
|
|
[ -d "$user_dir" ] || continue
|
|
user=$(basename "$user_dir")
|
|
history_file="$user_dir/.bash_history"
|
|
[ -f "$history_file" ] && file_sizes["$user"]=$(stat -c%s "$history_file" 2>/dev/null || echo 0)
|
|
done
|
|
|
|
# 主监控循环
|
|
while true; do
|
|
for user_dir in /home/* /root; do
|
|
[ -d "$user_dir" ] || continue
|
|
user=$(basename "$user_dir")
|
|
history_file="$user_dir/.bash_history"
|
|
[ -f "$history_file" ] || continue
|
|
|
|
current_size=$(stat -c%s "$history_file" 2>/dev/null || echo 0)
|
|
last_size=${file_sizes["$user"]:-0}
|
|
|
|
if [ "$current_size" -gt "$last_size" ]; then
|
|
new_cmd=$(tail -n 1 "$history_file" 2>/dev/null | sed 's/^[ \t]*//;s/[ \t]*$//')
|
|
if [ -n "$new_cmd" ] && [ ${#new_cmd} -gt 1 ]; then
|
|
# 过滤简单命令
|
|
case "$new_cmd" in
|
|
ls|cd|pwd|ll|history|exit|clear|cmdwatch|"."|"..")
|
|
continue
|
|
;;
|
|
*)
|
|
client_ip=$(get_client_ip)
|
|
timestamp=$(date '+%Y-%m-%d %H:%M:%S')
|
|
log_entry="[$timestamp] 用户:$user | 命令:$new_cmd | 来源:$client_ip"
|
|
echo "$log_entry" >> "$LOG_FILE"
|
|
file_sizes["$user"]=$current_size
|
|
;;
|
|
esac
|
|
fi
|
|
fi
|
|
done
|
|
sleep 1
|
|
done
|
|
) &
|
|
|
|
echo $! > "$PID_FILE"
|
|
echo "✅ 监控已启动 (PID: $!)"
|
|
}
|
|
|
|
# 命令处理
|
|
case "$1" in
|
|
start)
|
|
init_system
|
|
if ! get_lock; then
|
|
echo "❌ 监控已经在运行中"
|
|
exit 1
|
|
fi
|
|
|
|
if is_running; then
|
|
echo "✅ 监控已在运行中"
|
|
release_lock
|
|
exit 0
|
|
fi
|
|
|
|
stop_all_monitors
|
|
start_monitoring
|
|
release_lock
|
|
;;
|
|
|
|
stop)
|
|
init_system
|
|
stop_all_monitors
|
|
echo "✅ 所有监控已停止"
|
|
;;
|
|
|
|
status)
|
|
init_system
|
|
if is_running; then
|
|
pid=$(cat "$PID_FILE")
|
|
echo "✅ 监控运行中 (PID: $pid)"
|
|
echo "📝 日志文件: $LOG_FILE"
|
|
echo "📊 日志行数: $(wc -l < "$LOG_FILE" 2>/dev/null || echo 0)"
|
|
else
|
|
echo "❌ 监控未运行"
|
|
fi
|
|
;;
|
|
|
|
view|logs)
|
|
init_system
|
|
if [ "$2" = "-f" ] || [ "$1" = "view" ]; then
|
|
if [ -f "$LOG_FILE" ]; then
|
|
tail -f "$LOG_FILE"
|
|
else
|
|
echo "暂无日志"
|
|
fi
|
|
else
|
|
if [ -f "$LOG_FILE" ]; then
|
|
tail -20 "$LOG_FILE"
|
|
else
|
|
echo "暂无日志"
|
|
fi
|
|
fi
|
|
;;
|
|
|
|
install)
|
|
init_system
|
|
stop_all_monitors
|
|
|
|
# 设置开机自启动
|
|
echo "设置开机自启动..."
|
|
(crontab -l 2>/dev/null | grep -v "cmdwatch"; echo "@reboot /usr/local/bin/cmdwatch start >/dev/null 2>&1") | crontab -
|
|
|
|
# 设置命令别名
|
|
echo "设置命令别名..."
|
|
sed -i '/alias cmdwatch=/d' ~/.bashrc
|
|
echo "alias cw='/usr/local/bin/cmdwatch view'" >> ~/.bashrc
|
|
|
|
# 启动监控
|
|
/usr/local/bin/cmdwatch start
|
|
|
|
source ~/.bashrc
|
|
|
|
echo ""
|
|
echo "🎉 安装完成!"
|
|
echo "========================"
|
|
echo "使用方法:"
|
|
echo " cw # 查看实时监控"
|
|
echo " cmdwatch view # 查看实时监控"
|
|
echo " cmdwatch status # 查看状态"
|
|
echo " cmdwatch stop # 停止监控"
|
|
echo " cmdwatch logs # 查看历史日志"
|
|
;;
|
|
|
|
clean)
|
|
echo "🧹 彻底清理所有监控系统..."
|
|
# 停止所有
|
|
pkill -f "cmd_monitor"
|
|
pkill -f "monitor.sh"
|
|
pkill -f "mt"
|
|
pkill -f "mon"
|
|
pkill -f "cmdwatch"
|
|
|
|
# 清理文件
|
|
rm -rf /root/monitor
|
|
rm -rf /root/install
|
|
rm -rf /root/.cmdwatch
|
|
rm -f /usr/local/bin/mt
|
|
rm -f /usr/local/bin/mon
|
|
rm -f /tmp/*monitor*
|
|
rm -f /tmp/cmd_monitor.*
|
|
|
|
# 清理crontab
|
|
(crontab -l 2>/dev/null | grep -v -E "(monitor|cmd_monitor|mt|mon|cmdwatch)") | crontab -
|
|
|
|
# 清理别名
|
|
sed -i '/alias to=/d' ~/.bashrc
|
|
sed -i '/alias mon=/d' ~/.bashrc
|
|
sed -i '/alias mt=/d' ~/.bashrc
|
|
sed -i '/alias cw=/d' ~/.bashrc
|
|
|
|
source ~/.bashrc
|
|
echo "✅ 彻底清理完成"
|
|
;;
|
|
|
|
*)
|
|
echo "命令监控系统 (cmdwatch)"
|
|
echo "========================"
|
|
echo "使用方法:"
|
|
echo " cmdwatch start # 启动监控"
|
|
echo " cmdwatch stop # 停止监控"
|
|
echo " cmdwatch status # 查看状态"
|
|
echo " cmdwatch view # 实时查看"
|
|
echo " cmdwatch logs # 查看日志"
|
|
echo " cmdwatch install # 安装配置"
|
|
echo " cmdwatch clean # 彻底清理"
|
|
echo ""
|
|
echo "安装后使用: cw # 查看实时监控"
|
|
;;
|
|
esac
|
|
EOF
|
|
|
|
# 给执行权限
|
|
chmod +x /usr/local/bin/cmdwatch
|
|
|
|
# 安装并启动
|
|
echo "安装唯一监控系统..."
|
|
cmdwatch install
|
|
|
|
# 测试
|
|
echo "测试监控系统..."
|
|
cw
|