#CentOS安装后优化大全
1.修改网卡名称 2.网卡配置 3.设置语言及主机名 4.关闭SELinux及防火墙 5.优化ssh速度
6.关闭firewall防火墙 7.配置yum源 8.升级CentOS内核 9.CentOS安装常用软件 10.配置vim环境
11.配置时钟同步和时区 12.配置bash别名环境 13.CentOS7升级openssl 14.清理所有残留
cat > /etc/sysctl.d/k8s.conf << EOF
EOF
1.修改网卡名称
通常CentOS7、CentOS8的网卡名为ensXXX命名，而历史过往习惯为ethX，为符合经验和习惯，可通过如下方式修改：
cp -brpf /etc/udev/rules.d/70-persistent-net.rules /etc/udev/rules.d/70-persistent-net.rules.bak
rm -rf /etc/udev/rules.d/*-persistent-*.rules
cp -brpf /etc/default/grub /etc/default/grub.bak
sed -i 's/GRUB_CMDLINE_LINUX=\"/GRUB_CMDLINE_LINUX=\"net.ifnames=0 biosdevname=0 /g' /etc/default/grub
grub2-mkconfig -o /boot/grub2/grub.cfg > /dev/null
systemctl restart NetworkManager
systemctl enable NetworkManager
2.2 配置静态IP
2.2.1 CentOS6配置静态IP，对于CentOS6配置静态IP，可直接vi修改网卡配置文件，主要配置参数如下：
# vi /etc/sysconfig/network-scripts/ifcfg-eth0
TYPE=Ethernet
PROXY_METHOD=none
BROWSER_ONLY=no
BOOTPROTO=none
IPADDR=172.24.8.134
PREFIX=24
GATEWAY=172.24.8.2
DNS1=223.5.5.5
DNS2=223.6.6.6
DEFROUTE=yes
#IPV4_FAILURE_FATAL=no
#IPV6INIT=yes
#IPV6_AUTOCONF=yes
#IPV6_DEFROUTE=yes
#IPV6_FAILURE_FATAL=no
#IPV6_ADDR_GEN_MODE=stable-privacy
NAME=eth1
DEVICE=eth1
ONBOOT=yes
2.2.2 CentOS7配置静态IP
对于CentOS7配置静态IP，不推荐直接修改if-eth0网卡配置文件参数，最佳实践为使用nmcli命令进行配置：
nmcli connection add connection.autoconnect yes autoconnect yes ipv4.method manual con-name eth0 ifname eth0 ipv4.addresses 172.16.10.172/24 ipv4.dns 223.5.5.5 type ethernet mtu 1452 ipv4.gateway 172.16.10.1
nmcli c reload eth0
nmcli c up eth0
2.3 设置语言及主机名
在有时候需要设置主机名及系统语言。
hostnamectl set-hostname imxhy #设置主机名
localectl set-locale LANG=zh_CN.utf8 #设置为中文
localectl set-locale LANG=en_US.UTF-8 #设置为英文
设置时区
rm -f /etc/localtime
ln -s /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
1.同步时间服务 并关闭防火墙和selinux
ntpdate time1.aliyun.com && hwclock -w
# 设置同步时间,前提安装ntpdate
if ! crontab -l | grep ntpdate &>/dev/null ; then
(echo "* 1 * * * ntpdate ntp1.aliyun.com >/dev/null 2>&1";crontab -l) |crontab
fi
2.12 配置时钟同步
2.12.1 CentOS7时钟同步
# cp -brpf /etc/ntp.conf /etc/ntp.conf.bak
# wget http://down.linuxsb.com/myoptions/Aliyunntp.conf -O /etc/ntp.conf
# systemctl enable ntpd –now
2.12.2 CentOS8时钟同步
# cp -brpf /etc/chrony.conf /etc/chrony.conf.bak
# wget http://down.linuxsb.com/myoptions/Aliyunchrony.conf -O /etc/chrony.conf
# systemctl enable chronyd --now
2.5 关闭SELinux及防火墙
cp -brpf /etc/selinux/config /etc/selinux/config.bak
sed -i '/SELINUX/{s/permissive/disabled/}' /etc/selinux/config
# 关闭防火墙
if egrep "7.[0-9]" /etc/redhat-release &>/dev/null; then
systemctl stop firewalld
systemctl disable firewalld --now
elif egrep "6.[0-9]" /etc/redhat-release &>/dev/null; then
service iptables stop
chkconfig iptables off
fi
2.6 优化ssh访问速度
#对于某些情况，ssh登录Linux的时候，会尝试解析为DNS name，需要花费时间，可进行关闭。
sed -i 's/^UseDNS.*/UseDNS no/' /etc/ssh/sshd_config
sed -i 's/^#UseDNS.*/UseDNS no/' /etc/ssh/sshd_config
# SSH超时时间
if ! grep "TMOUT=600" /etc/profile &>/dev/null; then
echo "export TMOUT=600" >> /etc/profile
fi
#创建普通用户
#禁止root远程登录
useradd SSHuser
sed -i 's/#PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
2.7 优化yum源
这一项非常重要，通常默认的CentOS其yum源在国外，可如下修改为国内的yum源，此yum源文件为本人自行收录在个人站点上。
yum clean all
mv -b /etc/yum.repos.d/*.repo /etc/yum.repos.d/backup
#CentOS7配置
wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo
wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo
#CentOS7配置
wget -P /etc/yum.repos.d/ http://down.linuxsb.com/myoptions/CentOS7-Base-aliyun-ustc.repo
wget -P /etc/yum.repos.d/ http://down.linuxsb.com/myoptions/epel7-aliyun-ustc.repo
#CentOS8配置
wget -P /etc/yum.repos.d/ http://down.linuxsb.com/myoptions/CentOS8-Base-aliyun-ustc.repo
wget -P /etc/yum.repos.d/ http://down.linuxsb.com/myoptions/epel8-aliyun-ustc-modular.repo
wget -P /etc/yum.repos.d/ http://down.linuxsb.com/myoptions/epel8-aliyun-ustc-playground.repo
wget -P /etc/yum.repos.d/ http://down.linuxsb.com/myoptions/epel8-aliyun-ustc-testing-modular.repo
wget -P /etc/yum.repos.d/ http://down.linuxsb.com/myoptions/epel8-aliyun-ustc-testing.repo
wget -P /etc/yum.repos.d/ http://down.linuxsb.com/myoptions/epel8-aliyun-ustc.repo
2.9 安装常用软件：强烈建议安装系统的时候采用Minimal方式安装，然后需要什么软件安装什么软件
# 安装系统性能分析工具及其他
yum install gcc make autoconf vim sysstat net-tools iostat iftop iotp wget lrzsz lsof unzip openssh-clients net-tool ntpdate curl -y
2.9.1 CentOS7常用软件安装
# yum -y install tar bzip2 git gcc gcc-c++ make wget openssl-devel openssh-clients bash-completion net-tools vim ntp screen lrzsz bash-completion-extras epel-release openssl tree jq curl lvm2 yum-utils zlib zlib-devel libffi-devel --skip-broken xz chrony perl-Pod-Html
2.9.2 CentOS8常用软件安装
# rpm --import http://mirrors.ustc.edu.cn/centos/RPM-GPG-KEY-CentOS-Official
# rpm --import https://mirrors.aliyun.com/epel/RPM-GPG-KEY-EPEL-8
2.11 配置vim环境
对于经常使用vim的用户，配置一个属于自己的独立的vimrc环境，会让你显得非常有逼格，如下为本人分享的其中一个。
# cp -brpf /root/.vimrc /root/.vimrc.bak
# wget http://down.linuxsb.com/myoptions/my_Vimrc_Diy01_v1 -O /root/.vimrc
# wget http://down.linuxsb.com/myoptions/my_Vimrc_Diy02_v1 -O /etc/skel/.vimrc
2.13 配置bash别名环境
对于常用的命令，建议配置别名，提高工作效率，以下为本人常使用的别名。
# vim ~/.bashrc
export TERM=linux
alias sroot='su - root'
alias useradd='useradd -m'
alias rm='rm -i'
alias cp='cp -ia'
alias mv='mv -i'
alias dff='df -Th'
alias du='du -h'
alias gj='shutdown -h now'
alias cq='shutdown -r now'
alias vi='vim'
alias ls='ls -h --color=auto'
alias ll='ls -lh --color=auto'
alias grep='grep --color=auto'
alias freem='free -m'
alias cip='curl -s icanhazip.com'
# 历史命令显示操作时间
if ! grep HISTTIMEFORMAT /etc/bashrc; then
echo 'export HISTTIMEFORMAT="%F %T `whoami` "' >> /etc/bashrc
fi
# 禁止定时任务向发送邮件
sed -i 's/^MAILTO=root/MAILTO=""/' /etc/crontab
# 设置最大打开文件数
if ! grep "* soft nofile 65535" /etc/security/limits.conf &>/dev/null; then
cat >> /etc/security/limits.conf << EOF
* soft nofile 65535
* hard nofile 65535
EOF
fi
# 系统内核优化
cat >> /etc/sysctl.conf << EOF
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_tw_buckets = 20480
net.ipv4.tcp_max_syn_backlog = 20480
net.core.netdev_max_backlog = 262144
net.ipv4.tcp_fin_timeout = 20
EOF
# 减少SWAP使用
echo "0" > /proc/sys/vm/swappiness
2.8 升级内核
对于部分应用，需要升级CentOS内核，比如docker，可通过如下方式升级内核。
2.8.1 升级CentOS7内核
# rpm --import https://www.elrepo.org/RPM-GPG-KEY-elrepo.org
# yum -y install https://www.elrepo.org/elrepo-release-7.el7.elrepo.noarch.rpm
# mv -b /etc/yum.repos.d/elrepo.repo /etc/yum.repos.d/backup
# wget -P /etc/yum.repos.d/ http://down.linuxsb.com/myoptions/elrepo7.repo
# yum --disablerepo="*" --enablerepo="elrepo-kernel" install -y kernel-ml
# grub2-set-default 0
2.8.2 升级CentOS8内核
# rpm --import https://www.elrepo.org/RPM-GPG-KEY-elrepo.org
# rpm --import http://mirrors.ustc.edu.cn/centos/RPM-GPG-KEY-CentOS-Official
# yum -y install https://www.elrepo.org/elrepo-release-8.el8.elrepo.noarch.rpm
# mv -b /etc/yum.repos.d/elrepo.repo /etc/yum.repos.d/backup
# wget -P /etc/yum.repos.d/ http://down.linuxsb.com/myoptions/elrepo8.repo
# yum --disablerepo="*" --enablerepo="elrepo-kernel" install -y kernel-ml
# grub2-set-default 0
2.14 CentOS7升级openssl
曾经旧版openssl出现重大bug，建议升级为更新版本的openssl。
# cd /tmp
# wget http://down.linuxsb.com/software/openssl-1.1.1m.tar.gz --no-check-certificate
# tar -zxvf openssl-1.1.1m.tar.gz
# cd openssl-1.1.1m
# ./config --prefix=/usr/local/openssl no-zlib
# make && make install
# mv /usr/bin/openssl /usr/bin/openssl.bak
# ln -s /usr/local/openssl/bin/openssl /usr/bin/openssl
# ln -snf /usr/local/openssl/lib/libssl.so.1.1 /usr/lib64/libssl.so.1.1
# ln -snf /usr/local/openssl/lib/libcrypto.so.1.1 /usr/lib64/libcrypto.so.1.1
# mv /usr/include/openssl/ /usr/include/openssl.bak
# ln -s /usr/local/openssl/include/openssl /usr/include/openssl
# ln -s /usr/local/openssl/lib/libssl.so.1.1 /usr/local/lib64/libssl.so
# echo "/usr/local/openssl/lib" >> /etc/ld.so.conf
# echo "CentOS openssl update!"
2.17 清理垃圾
#对于优化/初始化完成后，在正式部署应用交付之前，建议将所有历史信息和垃圾清理掉。
rm -rf /var/log/anaconda/*
rm -rf /var/log/boot.log*
rm -rf /var/log/btmp*
rm -rf /var/log/chrony/*
rm -rf /var/log/cloud-init*
rm -rf /var/log/cron*
rm -rf /var/log/dmesg\.*
rm -rf /var/log/grubby*
rm -rf /var/log/dnf*
rm -rf /var/log/hawkey.log*
rm -rf /var/log/messages*
rm -rf /var/log/qemu-ga*
rm -rf /var/log/rhsm*
rm -rf /var/log/samba*
rm -rf /var/log/secure*
rm -rf /var/log/sssd*
rm -rf /var/log/tallylog
rm -rf /var/log/tuned*
rm -rf /var/log/dnf.*log
rm -rf /var/log/openwebmail.log
rm -rf /var/log/vmware*
rm -rf /var/log/update*.log
rm -rf /var/log/kdump.log
rm -rf /var/spool/mail/root
echo "" > /var/log/audit/audit.log
echo "" > /var/log/boot.log
echo "" > /var/log/btmp
echo "" > /var/log/dmesg
echo "" > /var/log/dnf.log
echo "" > /var/log/firewalld
echo "" > /var/log/httpd/access_log
echo "" > /var/log/httpd/error_log
echo "" > /var/log/syslog
echo "" > /var/log/lastlog
echo "" > /var/log/wtmp
echo "" > /var/log/maillog
echo "" > /var/log/messages
echo "" > /var/log/maillog
echo "" > /var/log/ntp.log
echo "" > /var/log/README
echo "" > /var/log/secure
echo "" > /var/log/spooler
echo "" > /var/log/yum.log
echo "" > $HOME/.bash_history
rm -rf /etc/yum.repos.d/epel.repo
rm -rf /etc/yum.repos.d/epel-*.repo
rm -rf /var/spool/mail/root
rm -rf /tmp/*
history -c
-------------------------------------------------------------------------------------------------------------
2.10 安装其他软件
建议安装额外运维小命令，如tcping、fping命令。
# mkdir -p /usr/local/tcping/sbin
# cd /tmp
# wget http://down.linuxsb.com/software/tcping-1.3.5-4-x86_64.tar.gz
# tar -zxvf tcping-1.3.5-4-x86_64.tar.gz
# mv usr/bin/tcping /usr/local/tcping/sbin/
# wget http://down.linuxsb.com/software/fping-5.0.tar.gz
# tar -zxvf fping-5.0.tar.gz
# cd fping-5.0/
# ./configure --prefix=/usr/local/fping
# make && make install
# echo 'export PATH=$PATH:/usr/local/tcping/sbin:/usr/local/fping/sbin' >> /root/.bashrc
2.15 CentOS7安装Python3.9
对于CentOS7而言，默认的Python为2.7，普通软件依赖高版本Python，可通过如下方式升级。
# cd /tmp
# pyversion=3.9.9
# wget https://mirrors.huaweicloud.com/python/${pyversion}/Python-${pyversion}.tar.xz --no-check-certificate
# tar -Jxvf Python-${pyversion}.tar.xz
# cd Python-${pyversion}/
# ./configure --prefix=/usr/local/python3 --with-openssl=/usr/local/openssl
# make && make install
# pyversionnew=`echo ${pyversion} | awk -F '.' '{ print $1"."$2 }'`
# cp -brpf /usr/local/python3/bin/{python,pip,pydoc}${pyversionnew} /usr/bin/
# cp -brpf /usr/local/python3/bin/python${pyversionnew}-config /usr/bin/
# pyversionold=`python -V 2>&1 | awk '{ print $2 }' | awk -F '.' '{ print $1"."$2 }'`
# pyversionnew=`echo ${pyversion} | awk -F '.' '{ print $1"."$2 }'`
# mv /usr/bin/python /usr/bin/python.bak
# alternatives --install /usr/bin/python python /usr/bin/python${pyversionold} 30
# alternatives --install /usr/bin/python python /usr/local/python3/bin/python${pyversionnew} 50
# alternatives --auto python
# ln -s /usr/bin/python${pyversionnew} /usr/bin/python3
# ln -s /usr/bin/pip${pyversionnew} /usr/bin/pip3
# ln -s /usr/bin/python${pyversionnew}-config /usr/bin/python3-config3
# echo 'export PATH=$PATH:/usr/local/python3/bin/' >> /root/.bashrc
# source /root/.bashrc
# sed -i '1s/python/python2.7/g' /usr/bin/yum* #仅可执行一次
# sed -i '1s/python/python2.7/g'
/usr/libexec/urlgrabber-ext-down #仅可执行一次
提示：对于Python多版本情况下，可能会出现一些依赖性问题，可参考 Python多版本环境管理 ，在系统存在多个版本Python的情况下借助第三方软件进行版本管理和切换。
2.16 配置国内pip源
对于Python而言，将pip源修改为国内也非常重要。
# mkdir -p ~/.pip
# cat > ~/.pip/pip.conf <<EOF
#[global]
# index-url = https://pypi.mirrors.ustc.edu.cn/simple/
# [install]
# trusted-host = pypi.mirrors.ustc.edu.cn
# EOF
# pip3 install --upgrade pip
# pip install pyreadline#
=======================================================
Dos 攻击防范（自动屏蔽攻击 IP）
#!/bin/bash
DATE=$(date +%d/%b/%Y:%H:%M)
LOG_FILE=/usr/local/nginx/logs/access.log
ABNORMAL_IP=$(tail -n5000 $LOG_FILE |grep $DATE |awk '{a[$1]++}END{for(i in a)if(a[i]>10)print i}')
for IP in $ABNORMAL_IP; do
if [ $(iptables -vnL |grep -c "$IP") -eq 0 ]; then
iptables -I INPUT -s $IP -j DROP
echo "$(date +'%F_%T') $IP" >> /tmp/drop_ip.log
fi
done
-------------------------------------------------------------------
Linux 系统发送告警脚本
# yum install mailx
# vi /etc/mail.rc
set from=baojingtongzhi@163.com smtp=smtp.163.com
set smtp-auth-user=baojingtongzhi@163.com smtp-auth-password=123456
set smtp-auth=login
MySQL 数据库备份单循环
#!/bin/bash
DATE=$(date +%F_%H-%M-%S)
HOST=localhost
USER=backup
PASS=123.com
BACKUP_DIR=/data/db_backup
DB_LIST=$(mysql -h$HOST -u$USER -p$PASS -s -e "show databases;" 2>/dev/null |egrep -v "Database|information_schema|mysql|performance_schema|sys")
for DB in $DB_LIST; do
BACKUP_NAME=$BACKUP_DIR/${DB}_${DATE}.sql
if ! mysqldump -h$HOST -u$USER -p$PASS -B $DB > $BACKUP_NAME 2>/dev/null; then
echo "$BACKUP_NAME 备份失败!"
fi
done
-------------------------------------------------------------------
MySQL 数据库备份多循环
#!/bin/bash
DATE=$(date +%F_%H-%M-%S)
HOST=localhost
USER=backup
PASS=123.com
BACKUP_DIR=/data/db_backup
DB_LIST=$(mysql -h$HOST -u$USER -p$PASS -s -e "show databases;" 2>/dev/null |egrep -v "Database|information_schema|mysql|performance_schema|sys")
for DB in $DB_LIST; do
BACKUP_DB_DIR=$BACKUP_DIR/${DB}_${DATE}
[ ! -d $BACKUP_DB_DIR ] && mkdir -p $BACKUP_DB_DIR &>/dev/null
TABLE_LIST=$(mysql -h$HOST -u$USER -p$PASS -s -e "use $DB;show tables;" 2>/dev/null)
for TABLE in $TABLE_LIST; do
BACKUP_NAME=$BACKUP_DB_DIR/${TABLE}.sql
if ! mysqldump -h$HOST -u$USER -p$PASS $DB $TABLE > $BACKUP_NAME 2>/dev/null; then
echo "$BACKUP_NAME 备份失败!"
fi
done
done
-------------------------------------------------------------------
Nginx 访问访问日志按天切割
#!/bin/bash
LOG_DIR=/usr/local/nginx/logs
YESTERDAY_TIME=$(date -d "yesterday" +%F)
LOG_MONTH_DIR=$LOG_DIR/$(date +"%Y-%m")
LOG_FILE_LIST="default.access.log"
for LOG_FILE in $LOG_FILE_LIST; do
[ ! -d $LOG_MONTH_DIR ] && mkdir -p $LOG_MONTH_DIR
mv $LOG_DIR/$LOG_FILE $LOG_MONTH_DIR/${LOG_FILE}_${YESTERDAY_TIME}
done
kill -USR1 $(cat /var/run/nginx.pid)
-------------------------------------------------------------------
Nginx 访问日志分析脚本
#!/bin/bash
# 日志格式: $remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" "$http_x_forwarded_for"
LOG_FILE=$1
echo "统计访问最多的10个IP"
awk '{a[$1]++}END{print "UV:",length(a);for(v in a)print v,a[v]}' $LOG_FILE |sort -k2 -nr |head -10
echo "----------------------"
echo "统计时间段访问最多的IP"
awk '$4>="[01/Dec/2018:13:20:25" && $4<="[27/Nov/2018:16:20:49"{a[$1]++}END{for(v in a)print v,a[v]}' $LOG_FILE |sort -k2 -nr|head -10
echo "----------------------"
echo "统计访问最多的10个页面"
awk '{a[$7]++}END{print "PV:",length(a);for(v in a){if(a[v]>10)print v,a[v]}}' $LOG_FILE |sort -k2 -nr
echo "----------------------"
echo "统计访问页面状态码数量"
awk '{a[$7" "$9]++}END{for(v in a){if(a[v]>5)print v,a[v]}}'
-------------------------------------------------------------------
查看网卡实时流量脚本
#!/bin/bash
NIC=$1
echo -e " In ------ Out"
while true; do
OLD_IN=$(awk '$0~"'$NIC'"{print $2}' /proc/net/dev)
OLD_OUT=$(awk '$0~"'$NIC'"{print $10}' /proc/net/dev)
sleep 1
NEW_IN=$(awk '$0~"'$NIC'"{print $2}' /proc/net/dev)
NEW_OUT=$(awk '$0~"'$NIC'"{print $10}' /proc/net/dev)
IN=$(printf "%.1f%s" "$((($NEW_IN-$OLD_IN)/1024))" "KB/s")
OUT=$(printf "%.1f%s" "$((($NEW_OUT-$OLD_OUT)/1024))" "KB/s")
echo "$IN $OUT"
sleep 1
done
-------------------------------------------------------------------
-------------------------------------------------------------------
监控 100 台服务器磁盘利用率脚本
#!/bin/bash
HOST_INFO=host.info
for IP in $(awk '/^[^#]/{print $1}' $HOST_INFO); do
USER=$(awk -v ip=$IP 'ip==$1{print $2}' $HOST_INFO)
PORT=$(awk -v ip=$IP 'ip==$1{print $3}' $HOST_INFO)
TMP_FILE=/tmp/disk.tmp
ssh -p $PORT $USER@$IP 'df -h' > $TMP_FILE
USE_RATE_LIST=$(awk 'BEGIN{OFS="="}/^\/dev/{print $NF,int($5)}' $TMP_FILE)
for USE_RATE in $USE_RATE_LIST; do
PART_NAME=${USE_RATE%=*}
USE_RATE=${USE_RATE#*=}
if [ $USE_RATE -ge 80 ]; then
echo "Warning: $PART_NAME Partition usage $USE_RATE%!"
fi
done
done
-------------------------------------------------------------------
2、批量创建多个用户并设置密码
#!/bin/bash
USER_LIST=$@
USER_FILE=./user.info
for USER in $USER_LIST;do
if ! id $USER &>/dev/null; then
PASS=$(echo $RANDOM |md5sum |cut -c 1-8)
useradd $USER
echo $PASS | passwd --stdin $USER &>/dev/null
echo "$USER $PASS" >> $USER_FILE
echo "$USER User create successful."
else
echo "$USER User already exists!"
fi
done
3、一键查看服务器利用率
#!/bin/bash
function cpu(){
util=$(vmstat | awk '{if(NR==3)print $13+$14}')
iowait=$(vmstat | awk '{if(NR==3)print $16}')
echo "CPU -使用率：${util}% ,等待磁盘IO相应使用率：${iowait}:${iowait}%"
}
function memory (){
total=`free -m |awk '{if(NR==2)printf "%.1f",$2/1024}'`
used=`free -m |awk '{if(NR==2) printf "%.1f",($2-$NF)/1024}'`
available=`free -m |awk '{if(NR==2) printf "%.1f",$NF/1024}'`
echo "内存 - 总大小: ${total}G , 使用: ${used}G , 剩余: ${available}G"
}
disk(){
fs=$(df -h |awk '/^\/dev/{print $1}')
for p in $fs; do
mounted=$(df -h |awk '$1=="'$p'"{print $NF}')
size=$(df -h |awk '$1=="'$p'"{print $2}')
used=$(df -h |awk '$1=="'$p'"{print $3}')
used_percent=$(df -h |awk '$1=="'$p'"{print $5}')
echo "硬盘 - 挂载点: $mounted , 总大小: $size , 使用: $used , 使用率: $used_percent"
done
}
function tcp_status() {
summary=$(ss -antp |awk '{status[$1]++}END{for(i in status) printf i":"status[i]" "}')
echo "TCP连接状态 - $summary"
}
cpu
memory
disk
tcp_status
4、找出占用CPU 内存过高的进程
#!/bin/bash
echo "-------------------CUP占用前10排序--------------------------------"
ps -eo user,pid,pcpu,pmem,args --sort=-pcpu |head -n 10
echo "-------------------内存占用前10排序--------------------------------"
ps -eo user,pid,pcpu,pmem,args --sort=-pmem |head -n 10
5、查看网卡的实时流量
#!/bin/bash
eth0=$1
echo -e "流量进入--流量传出 "
while true; do
old_in=$(cat /proc/net/dev |grep $eth0 |awk '{print $2}')
old_out=$(cat /proc/net/dev |grep $eth0 |awk '{print $10}')
sleep 1
new_in=$(cat /proc/net/dev |grep $eth0 |awk '{print $2}')
new_out=$(cat /proc/net/dev |grep $eth0 |awk '{print $10}')
in=$(printf "%.1f%s" "$((($new_in-$old_in)/1024))" "KB/s")
out=$(printf "%.1f%s" "$((($new_out-$old_out)/1024))" "KB/s")
echo "$in $out"
done
6、监控多台服务器磁盘利用率脚本
#!/bin/bash
HOST_INFO=host.info
for IP in $(awk '/^[^#]/{print $1}' $HOST_INFO); do
#取出用户名和端口
USER=$(awk -v ip=$IP 'ip==$1{print $2}' $HOST_INFO)
PORT=$(awk -v ip=$IP 'ip==$1{print $3}' $HOST_INFO)
#创建临时文件，保存信息
TMP_FILE=/tmp/disk.tmp
#通过公钥登录获取主机磁盘信息
ssh -p $PORT $USER@$IP 'df -h' > $TMP_FILE
#分析磁盘占用空间
USE_RATE_LIST=$(awk 'BEGIN{OFS="="}/^\/dev/{print $NF,int($5)}' $TMP_FILE)
#循环磁盘列表，进行判断
for USE_RATE in $USE_RATE_LIST; do
#取出等号（=）右边的值 挂载点名称
PART_NAME=${USE_RATE%=*}
#取出等号（=）左边的值 磁盘利用率
USE_RATE=${USE_RATE#*=}
#进行判断
if [ $USE_RATE -ge 80 ]; then
echo "Warning: $PART_NAME Partition usage $USE_RATE%!"
echo "服务器$IP的磁盘空间占用过高，请及时处理" | mail -s "空间不足警告" 你的qq@qq.com
else
echo "服务器$IP的$PART_NAME目录空间良好"
fi
done
done
7、批量检测网站是否异常并邮件通知
#!/bin/bash
URL_LIST="www.baidu.com www.ctnrs.com www.der-matech.net.cn www.der-matech.com.cn www.der-matech.cn www.der-matech.top www.der-matech.org"
for URL in $URL_LIST; do
FAIL_COUNT=0
for ((i=1;i<=3;i++)); do
HTTP_CODE=$(curl -o /dev/null --connect-timeout 3 -s -w "%{http_code}" $URL)
if [ $HTTP_CODE -eq 200 ]; then
echo "$URL OK"
break
else
echo "$URL retry $FAIL_COUNT"
let FAIL_COUNT++
fi
done
if [ $FAIL_COUNT -eq 3 ]; then
echo "Warning: $URL Access failure!"
echo "网站$URL坏掉，请及时处理" | mail -s "$URL网站高危" 1794748404@qq.com
fi
done
8、批量主机远程执行命令脚本
#!/bin/bash
COMMAND=$*
HOST_INFO=host.info
for IP in $(awk '/^[^#]/{print $1}' $HOST_INFO); do
USER=$(awk -v ip=$IP 'ip==$1{print $2}' $HOST_INFO)
PORT=$(awk -v ip=$IP 'ip==$1{print $3}' $HOST_INFO)
PASS=$(awk -v ip=$IP 'ip==$1{print $4}' $HOST_INFO)
expect -c "
spawn ssh -p $PORT $USER@$IP
expect {
\"(yes/no)\" {send \"yes\r\"; exp_continue}
\"password:\" {send \"$PASS\r\"; exp_continue}
\"$USER@*\" {send \"$COMMAND\r exit\r\"; exp_continue}
}
"
echo "-------------------"
done
9、一键部署LNMP网站平台脚本
#!/bin/bash
NGINX_V=1.15.6
PHP_V=5.6.36
TMP_DIR=/tmp
INSTALL_DIR=/usr/local
PWD_C=$PWD
echo
echo -e "\tMenu\n"
echo -e "1. Install Nginx"
echo -e "2. Install PHP"
echo -e "3. Install MySQL"
echo -e "4. Deploy LNMP"
echo -e "9. Quit"
function command_status_check() {
if [ $? -ne 0 ]; then
echo $1
exit
fi
}
function install_nginx() {
cd $TMP_DIR
yum install -y gcc gcc-c++ make openssl-devel pcre-devel wget
wget http://nginx.org/download/nginx-${NGINX_V}.tar.gz
tar zxf nginx-${NGINX_V}.tar.gz
cd nginx-${NGINX_V}
./configure --prefix=$INSTALL_DIR/nginx \
--with-http_ssl_module \
--with-http_stub_status_module \
--with-stream
command_status_check "Nginx - 平台环境检查失败！"
make -j 4
command_status_check "Nginx - 编译失败！"
make install
command_status_check "Nginx - 安装失败！"
mkdir -p $INSTALL_DIR/nginx/conf/vhost
alias cp=cp ; cp -rf $PWD_C/nginx.conf $INSTALL_DIR/nginx/conf
rm -rf $INSTALL_DIR/nginx/html/*
echo "ok" > $INSTALL_DIR/nginx/html/status.html
echo '<?php echo "ok"?>' > $INSTALL_DIR/nginx/html/status.php
$INSTALL_DIR/nginx/sbin/nginx
command_status_check "Nginx - 启动失败！"
}
function install_php() {
cd $TMP_DIR
yum install -y gcc gcc-c++ make gd-devel libxml2-devel \
libcurl-devel libjpeg-devel libpng-devel openssl-devel \
libmcrypt-devel libxslt-devel libtidy-devel
wget http://docs.php.net/distributions/php-${PHP_V}.tar.gz
tar zxf php-${PHP_V}.tar.gz
cd php-${PHP_V}
./configure --prefix=$INSTALL_DIR/php \
--with-config-file-path=$INSTALL_DIR/php/etc \
--enable-fpm --enable-opcache \
--with-mysql --with-mysqli --with-pdo-mysql \
--with-openssl --with-zlib --with-curl --with-gd \
--with-jpeg-dir --with-png-dir --with-freetype-dir \
--enable-mbstring --enable-hash
command_status_check "PHP - 平台环境检查失败！"
make -j 4
command_status_check "PHP - 编译失败！"
make install
command_status_check "PHP - 安装失败！"
cp php.ini-production $INSTALL_DIR/php/etc/php.ini
cp sapi/fpm/php-fpm.conf $INSTALL_DIR/php/etc/php-fpm.conf
cp sapi/fpm/init.d.php-fpm /etc/init.d/php-fpm
chmod +x /etc/init.d/php-fpm
/etc/init.d/php-fpm start
command_status_check "PHP - 启动失败！"
}
read -p "请输入编号：" number
case $number in
1)
install_nginx;;
2)
install_php;;
3)
install_mysql;;
4)
install_nginx
install_php
;;
9)
exit;;
esac
10、监控MySQL主从同步状态是否异常脚本
#!/bin/bash
HOST=localhost
USER=root
PASSWD=123.com
IO_SQL_STATUS=$(mysql -h$HOST -u$USER -p$PASSWD -e 'show slave status\G' 2>/dev/null |awk '/Slave_.*_Running:/{print $1$2}')
for i in $IO_SQL_STATUS; do
THREAD_STATUS_NAME=${i%:*}
THREAD_STATUS=${i#*:}
if [ "$THREAD_STATUS" != "Yes" ]; then
echo "Error: MySQL Master-Slave $THREAD_STATUS_NAME status is $THREAD_STATUS!" |mail -s "Master-Slave Staus" xxx@163.com
fi
done
11、MySql数据库备份脚本
分库备份
mysqldump -uroot -pxxx -B A > A.sql
#!/bin/bash
DATE=$(date +%F_%H-%M-%S)
HOST=localhost
USER=backup
PASS=123.com
BACKUP_DIR=/data/db_backup
DB_LIST=$(mysql -h$HOST -u$USER -p$PASS -s -e "show databases;" 2>/dev/null |egrep -v "Database|information_schema|mysql|performance_schema|sys")
for DB in $DB_LIST; do
BACKUP_NAME=$BACKUP_DIR/${DB}_${DATE}.sql
if ! mysqldump -h$HOST -u$USER -p$PASS -B $DB > $BACKUP_NAME 2>/dev/null; then
echo "$BACKUP_NAME 备份失败!"
fi
done
分表备份
mysqldump -uroot -pxxx -A t > t.sql
#!/bin/bash
DATE=$(date +%F_%H-%M-%S)
HOST=localhost
USER=backup
PASS=123.com
BACKUP_DIR=/data/db_backup
DB_LIST=$(mysql -h$HOST -u$USER -p$PASS -s -e "show databases;" 2>/dev/null |egrep -v "Database|information_schema|mysql|performance_schema|sys")
for DB in $DB_LIST; do
BACKUP_DB_DIR=$BACKUP_DIR/${DB}_${DATE}
[ ! -d $BACKUP_DB_DIR ] && mkdir -p $BACKUP_DB_DIR &>/dev/null
TABLE_LIST=$(mysql -h$HOST -u$USER -p$PASS -s -e "use $DB;show tables;" 2>/dev/null)
for TABLE in $TABLE_LIST; do
BACKUP_NAME=$BACKUP_DB_DIR/${TABLE}.sql
if ! mysqldump -h$HOST -u$USER -p$PASS $DB $TABLE > $BACKUP_NAME 2>/dev/null; then
echo "$BACKUP_NAME 备份失败!"
fi
done
done
12、Nginx访问日志分析
#!/bin/bash
# 日志格式: $remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" "$http_x_forwarded_for"
LOG_FILE=$1
echo "统计访问最多的10个IP"
awk '{a[$1]++}END{print "UV:",length(a);for(v in a)print v,a[v]}' $LOG_FILE |sort -k2 -nr |head -10
echo "----------------------"
echo "统计时间段访问最多的IP"
awk '$4>="[01/Dec/2018:13:20:25" && $4<="[27/Nov/2018:16:20:49"{a[$1]++}END{for(v in a)print v,a[v]}' $LOG_FILE |sort -k2 -nr|head -10
echo "----------------------"
echo "统计访问最多的10个页面"
awk '{a[$7]++}END{print "PV:",length(a);for(v in a){if(a[v]>10)print v,a[v]}}' $LOG_FILE |sort -k2 -nr
echo "----------------------"
echo "统计访问页面状态码数量"
awk '{a[$7" "$9]++}END{for(v in a){if(a[v]>5)print v,a[v]}}' $LOG_FILE |sort -k3 -nr
13、Nginx访问日志自动按天（周、月）切割
#!/bin/bash
#nginx日志目录
LOG_DIR=/www/server/nginx/logs
#获取到上一天的时间
YESTERDAY_TIME=$(date -d "yesterday" +%F)
#归档日志取时间
LOG_MONTH_DIR=$LOG_DIR/$(date +"%Y-%m")
#归档日志的名称
LOG_FILE_LIST="access.log"
for LOG_FILE in $LOG_FILE_LIST; do
[ ! -d $LOG_MONTH_DIR ] && mkdir -p $LOG_MONTH_DIR
mv $LOG_DIR/$LOG_FILE $LOG_MONTH_DIR/${LOG_FILE}_${YESTERDAY_TIME}
done
kill -USR1 $(cat $LOG_DIR/nginx.pid)
14、自动发布Java项目（Tomcat）
#!/bin/bash
DATE=$(date +%F_%T)
TOMCAT_NAME=$1
TOMCAT_DIR=/usr/local/$TOMCAT_NAME
ROOT=$TOMCAT_DIR/webapps/ROOT
BACKUP_DIR=/data/backup
WORK_DIR=/tmp
PROJECT_NAME=tomcat-java-demo
# 拉取代码
cd $WORK_DIR
if [ ! -d $PROJECT_NAME ]; then
git clone https://github.com/lizhenliang/tomcat-java-demo
cd $PROJECT_NAME
else
cd $PROJECT_NAME
git pull
fi
# 构建
mvn clean package -Dmaven.test.skip=true
if [ $? -ne 0 ]; then
echo "maven build failure!"
exit 1
fi
# 部署
TOMCAT_PID=$(ps -ef |grep "$TOMCAT_NAME" |egrep -v "grep|$$" |awk 'NR==1{print $2}')
[ -n "$TOMCAT_PID" ] && kill -9 $TOMCAT_PID
[ -d $ROOT ] && mv $ROOT $BACKUP_DIR/${TOMCAT_NAME}_ROOT$DATE
unzip $WORK_DIR/$PROJECT_NAME/target/*.war -d $ROOT
$TOMCAT_DIR/bin/startup.sh
15、自动发布PHP项目
#!/bin/bash
DATE=$(date +%F_%T)
WWWROOT=/usr/local/nginx/html/$1
BACKUP_DIR=/data/backup
WORK_DIR=/tmp
PROJECT_NAME=php-demo
# 拉取代码
cd $WORK_DIR
if [ ! -d $PROJECT_NAME ]; then
git clone https://github.com/lizhenliang/php-demo
cd $PROJECT_NAME
else
cd $PROJECT_NAME
git pull
fi
# 部署
if [ ! -d $WWWROOT ]; then
mkdir -p $WWWROOT
rsync -avz --exclude=.git $WORK_DIR/$PROJECT_NAME/* $WWWROOT
else
rsync -avz --exclude=.git $WORK_DIR/$PROJECT_NAME/* $WWWROOT
fi
16、DOS攻击防范（自动屏蔽攻击IP）
#!/bin/bash
DATE=$(date +%d/%b/%Y:%H:%M)
#nginx日志
LOG_FILE=/usr/local/nginx/logs/demo2.access.log
#分析ip的访问情况
ABNORMAL_IP=$(tail -n5000 $LOG_FILE |grep $DATE |awk '{a[$1]++}END{for(i in a)if(a[i]>10)print i}')
for IP in $ABNORMAL_IP; do
if [ $(iptables -vnL |grep -c "$IP") -eq 0 ]; then
iptables -I INPUT -s $IP -j DROP
echo "$(date +'%F_%T') $IP" >> /tmp/drop_ip.log
fi
done
17、目录入侵检测与告警
#!/bin/bash
MON_DIR=/opt
inotifywait -mqr --format %f -e create $MON_DIR |\
while read files; do
#同步文件
rsync -avz /opt /tmp/opt
#检测文件是否被修改
#echo "$(date +'%F %T') create $files" | mail -s "dir monitor" xxx@163.com
done
