CentOS安装后优化

?
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
#CentOS安装后优化大全
 
1.修改网卡名称 2.网卡配置 3.设置语言及主机名  4.关闭SELinux及防火墙 5.优化ssh速度
6.关闭firewall防火墙 7.配置yum源        8.升级CentOS内核    9.CentOS安装常用软件  10.配置vim环境
11.配置时钟同步和时区     12.配置bash别名环境   13.CentOS7升级openssl   14.清理所有残留
 
cat > /etc/sysctl.d/k8s.conf << EOF
 
EOF
 
 
1.修改网卡名称
通常CentOS7、CentOS8的网卡名为ensXXX命名，而历史过往习惯为ethX，为符合经验和习惯，可通过如下方式修改：
cp -brpf /etc/udev/rules.d/70-persistent-net.rules /etc/udev/rules.d/70-persistent-net.rules.bak
rm -rf /etc/udev/rules.d/*-persistent-*.rules
cp -brpf /etc/default/grub /etc/default/grub.bak
sed -i 's/GRUB_CMDLINE_LINUX=\"/GRUB_CMDLINE_LINUX=\"net.ifnames=0 biosdevname=0 /g' /etc/default/grub
grub2-mkconfig -o /boot/grub2/grub.cfg > /dev/null
systemctl restart NetworkManager
systemctl enable NetworkManager
 
2.2 配置静态IP
2.2.1 CentOS6配置静态IP，对于CentOS6配置静态IP，可直接vi修改网卡配置文件，主要配置参数如下：
# vi /etc/sysconfig/network-scripts/ifcfg-eth0
TYPE=Ethernet
PROXY_METHOD=none
BROWSER_ONLY=no
BOOTPROTO=none
IPADDR=172.24.8.134
PREFIX=24
GATEWAY=172.24.8.2
DNS1=223.5.5.5
DNS2=223.6.6.6
DEFROUTE=yes
#IPV4_FAILURE_FATAL=no
#IPV6INIT=yes
#IPV6_AUTOCONF=yes
#IPV6_DEFROUTE=yes
#IPV6_FAILURE_FATAL=no
#IPV6_ADDR_GEN_MODE=stable-privacy
NAME=eth1
DEVICE=eth1
ONBOOT=yes
 
2.2.2 CentOS7配置静态IP
对于CentOS7配置静态IP，不推荐直接修改if-eth0网卡配置文件参数，最佳实践为使用nmcli命令进行配置：
nmcli connection add connection.autoconnect yes autoconnect yes ipv4.method manual con-name eth0 ifname eth0 ipv4.addresses 172.16.10.172/24 ipv4.dns 223.5.5.5 type ethernet mtu 1452 ipv4.gateway 172.16.10.1
nmcli c reload eth0
nmcli c up eth0
 
2.3 设置语言及主机名
在有时候需要设置主机名及系统语言。
hostnamectl set-hostname imxhy #设置主机名
localectl set-locale LANG=zh_CN.utf8 #设置为中文
localectl set-locale LANG=en_US.UTF-8 #设置为英文
  
设置时区
 rm -f /etc/localtime 
ln -s /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
 
1.同步时间服务 并关闭防火墙和selinux
ntpdate   time1.aliyun.com && hwclock  -w
 
 
# 设置同步时间,前提安装ntpdate
if ! crontab -l | grep ntpdate &>/dev/null ; then
    (echo "* 1 * * * ntpdate ntp1.aliyun.com >/dev/null 2>&1";crontab -l) |crontab
fi
 
2.12 配置时钟同步
2.12.1 CentOS7时钟同步
# cp -brpf /etc/ntp.conf /etc/ntp.conf.bak
# wget http://down.linuxsb.com/myoptions/Aliyunntp.conf -O /etc/ntp.conf
# systemctl enable ntpd –now
 
2.12.2 CentOS8时钟同步
# cp -brpf /etc/chrony.conf /etc/chrony.conf.bak
# wget http://down.linuxsb.com/myoptions/Aliyunchrony.conf -O /etc/chrony.conf
# systemctl enable chronyd --now
 
 
2.5 关闭SELinux及防火墙
cp -brpf /etc/selinux/config /etc/selinux/config.bak
sed -i '/SELINUX/{s/permissive/disabled/}' /etc/selinux/config
 
 
 
# 关闭防火墙
if egrep "7.[0-9]" /etc/redhat-release &>/dev/null; then
    systemctl stop firewalld
    systemctl disable firewalld --now
elif egrep "6.[0-9]" /etc/redhat-release &>/dev/null; then
    service iptables stop
    chkconfig iptables off
fi
 
2.6 优化ssh访问速度
#对于某些情况，ssh登录Linux的时候，会尝试解析为DNS name，需要花费时间，可进行关闭。
sed -i 's/^UseDNS.*/UseDNS no/' /etc/ssh/sshd_config
sed -i 's/^#UseDNS.*/UseDNS no/' /etc/ssh/sshd_config
 
# SSH超时时间
if ! grep "TMOUT=600" /etc/profile &>/dev/null; then
    echo "export TMOUT=600" >> /etc/profile
fi
 
#创建普通用户
#禁止root远程登录
useradd SSHuser
sed -i 's/#PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
 
 
2.7 优化yum源
 
这一项非常重要，通常默认的CentOS其yum源在国外，可如下修改为国内的yum源，此yum源文件为本人自行收录在个人站点上。
yum clean all
mv -b /etc/yum.repos.d/*.repo /etc/yum.repos.d/backup
 
#CentOS7配置
wget -O /etc/yum.repos.d/CentOS-Base.repo  http://mirrors.aliyun.com/repo/Centos-7.repo
wget -O /etc/yum.repos.d/epel.repo         http://mirrors.aliyun.com/repo/epel-7.repo
 
#CentOS7配置
wget -P /etc/yum.repos.d/ http://down.linuxsb.com/myoptions/CentOS7-Base-aliyun-ustc.repo
wget -P /etc/yum.repos.d/ http://down.linuxsb.com/myoptions/epel7-aliyun-ustc.repo
 
#CentOS8配置
wget -P /etc/yum.repos.d/ http://down.linuxsb.com/myoptions/CentOS8-Base-aliyun-ustc.repo
wget -P /etc/yum.repos.d/ http://down.linuxsb.com/myoptions/epel8-aliyun-ustc-modular.repo
wget -P /etc/yum.repos.d/ http://down.linuxsb.com/myoptions/epel8-aliyun-ustc-playground.repo
wget -P /etc/yum.repos.d/ http://down.linuxsb.com/myoptions/epel8-aliyun-ustc-testing-modular.repo
wget -P /etc/yum.repos.d/ http://down.linuxsb.com/myoptions/epel8-aliyun-ustc-testing.repo
wget -P /etc/yum.repos.d/ http://down.linuxsb.com/myoptions/epel8-aliyun-ustc.repo
 
 
 
 
2.9 安装常用软件：强烈建议安装系统的时候采用Minimal方式安装，然后需要什么软件安装什么软件
 
# 安装系统性能分析工具及其他
yum install gcc make autoconf vim sysstat net-tools iostat iftop iotp wget lrzsz lsof unzip openssh-clients net-tool  ntpdate curl -y
 
2.9.1 CentOS7常用软件安装
# yum -y install tar bzip2 git gcc gcc-c++ make wget openssl-devel openssh-clients bash-completion net-tools vim ntp screen lrzsz bash-completion-extras epel-release openssl tree jq curl lvm2 yum-utils zlib zlib-devel libffi-devel --skip-broken xz chrony  perl-Pod-Html
 
2.9.2 CentOS8常用软件安装
# rpm --import http://mirrors.ustc.edu.cn/centos/RPM-GPG-KEY-CentOS-Official
# rpm --import https://mirrors.aliyun.com/epel/RPM-GPG-KEY-EPEL-8
 
 
 
 
 
 
 
2.11 配置vim环境
对于经常使用vim的用户，配置一个属于自己的独立的vimrc环境，会让你显得非常有逼格，如下为本人分享的其中一个。
# cp -brpf /root/.vimrc /root/.vimrc.bak
# wget http://down.linuxsb.com/myoptions/my_Vimrc_Diy01_v1 -O /root/.vimrc
# wget http://down.linuxsb.com/myoptions/my_Vimrc_Diy02_v1 -O /etc/skel/.vimrc
 
 
2.13 配置bash别名环境
对于常用的命令，建议配置别名，提高工作效率，以下为本人常使用的别名。
# vim ~/.bashrc
export TERM=linux
alias sroot='su - root'
alias useradd='useradd -m'
alias rm='rm -i'
alias cp='cp -ia'
alias mv='mv -i'
alias dff='df -Th'
alias du='du -h'
alias gj='shutdown -h now'
alias cq='shutdown -r now'
alias vi='vim'
alias ls='ls -h --color=auto'
alias ll='ls -lh --color=auto'
alias grep='grep --color=auto'
alias freem='free -m'
alias cip='curl -s icanhazip.com'
 
 
# 历史命令显示操作时间
if ! grep HISTTIMEFORMAT /etc/bashrc; then
    echo 'export HISTTIMEFORMAT="%F %T `whoami` "' >> /etc/bashrc
fi
 
 
 
# 禁止定时任务向发送邮件
sed -i 's/^MAILTO=root/MAILTO=""/' /etc/crontab
 
 
 
# 设置最大打开文件数
if ! grep "* soft nofile 65535" /etc/security/limits.conf &>/dev/null; then
    cat >> /etc/security/limits.conf << EOF
    * soft nofile 65535
    * hard nofile 65535
EOF
fi
 
# 系统内核优化
cat >> /etc/sysctl.conf << EOF
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_tw_buckets = 20480
net.ipv4.tcp_max_syn_backlog = 20480
net.core.netdev_max_backlog = 262144
net.ipv4.tcp_fin_timeout = 20
EOF
 
# 减少SWAP使用
echo "0" > /proc/sys/vm/swappiness
 
 
2.8 升级内核
对于部分应用，需要升级CentOS内核，比如docker，可通过如下方式升级内核。
2.8.1 升级CentOS7内核
# rpm --import https://www.elrepo.org/RPM-GPG-KEY-elrepo.org
# yum -y install https://www.elrepo.org/elrepo-release-7.el7.elrepo.noarch.rpm
# mv -b /etc/yum.repos.d/elrepo.repo /etc/yum.repos.d/backup
# wget -P /etc/yum.repos.d/ http://down.linuxsb.com/myoptions/elrepo7.repo
# yum --disablerepo="*" --enablerepo="elrepo-kernel" install -y kernel-ml
# grub2-set-default 0
 
2.8.2 升级CentOS8内核
# rpm --import https://www.elrepo.org/RPM-GPG-KEY-elrepo.org
# rpm --import http://mirrors.ustc.edu.cn/centos/RPM-GPG-KEY-CentOS-Official
# yum -y install https://www.elrepo.org/elrepo-release-8.el8.elrepo.noarch.rpm
# mv -b /etc/yum.repos.d/elrepo.repo /etc/yum.repos.d/backup
# wget -P /etc/yum.repos.d/ http://down.linuxsb.com/myoptions/elrepo8.repo
# yum --disablerepo="*" --enablerepo="elrepo-kernel" install -y kernel-ml
# grub2-set-default 0
 
 
 
2.14 CentOS7升级openssl
曾经旧版openssl出现重大bug，建议升级为更新版本的openssl。
# cd /tmp
# wget http://down.linuxsb.com/software/openssl-1.1.1m.tar.gz --no-check-certificate
# tar -zxvf openssl-1.1.1m.tar.gz
# cd openssl-1.1.1m
# ./config --prefix=/usr/local/openssl no-zlib
# make && make install
# mv /usr/bin/openssl /usr/bin/openssl.bak
# ln -s /usr/local/openssl/bin/openssl /usr/bin/openssl
# ln -snf /usr/local/openssl/lib/libssl.so.1.1 /usr/lib64/libssl.so.1.1
# ln -snf /usr/local/openssl/lib/libcrypto.so.1.1 /usr/lib64/libcrypto.so.1.1
# mv /usr/include/openssl/ /usr/include/openssl.bak
# ln -s /usr/local/openssl/include/openssl /usr/include/openssl
# ln -s /usr/local/openssl/lib/libssl.so.1.1 /usr/local/lib64/libssl.so
# echo "/usr/local/openssl/lib" >> /etc/ld.so.conf
# echo "CentOS openssl update!"
 
 
 
2.17 清理垃圾
#对于优化/初始化完成后，在正式部署应用交付之前，建议将所有历史信息和垃圾清理掉。
rm -rf /var/log/anaconda/*
rm -rf /var/log/boot.log*
rm -rf /var/log/btmp*
rm -rf /var/log/chrony/*
rm -rf /var/log/cloud-init*
rm -rf /var/log/cron*
rm -rf /var/log/dmesg\.*
rm -rf /var/log/grubby*
rm -rf /var/log/dnf*
rm -rf /var/log/hawkey.log*
rm -rf /var/log/messages*
rm -rf /var/log/qemu-ga*
rm -rf /var/log/rhsm*
rm -rf /var/log/samba*
rm -rf /var/log/secure*
rm -rf /var/log/sssd*
rm -rf /var/log/tallylog
rm -rf /var/log/tuned*
rm -rf /var/log/dnf.*log
rm -rf /var/log/openwebmail.log
rm -rf /var/log/vmware*
rm -rf /var/log/update*.log
rm -rf /var/log/kdump.log
rm -rf /var/spool/mail/root
echo "" > /var/log/audit/audit.log
echo "" > /var/log/boot.log
echo "" > /var/log/btmp
echo "" > /var/log/dmesg
echo "" > /var/log/dnf.log
echo "" > /var/log/firewalld
echo "" > /var/log/httpd/access_log
echo "" > /var/log/httpd/error_log
echo "" > /var/log/syslog
echo "" > /var/log/lastlog
echo "" > /var/log/wtmp
echo "" > /var/log/maillog
echo "" > /var/log/messages
echo "" > /var/log/maillog
echo "" > /var/log/ntp.log
echo "" > /var/log/README
echo "" > /var/log/secure
echo "" > /var/log/spooler
echo "" > /var/log/yum.log
echo "" > $HOME/.bash_history
rm -rf /etc/yum.repos.d/epel.repo
rm -rf /etc/yum.repos.d/epel-*.repo
rm -rf /var/spool/mail/root
rm -rf /tmp/*
history -c
 
 
 
 
 
 
-------------------------------------------------------------------------------------------------------------
2.10 安装其他软件
建议安装额外运维小命令，如tcping、fping命令。
# mkdir -p /usr/local/tcping/sbin
# cd /tmp
# wget http://down.linuxsb.com/software/tcping-1.3.5-4-x86_64.tar.gz
# tar -zxvf tcping-1.3.5-4-x86_64.tar.gz
# mv usr/bin/tcping /usr/local/tcping/sbin/
# wget http://down.linuxsb.com/software/fping-5.0.tar.gz
# tar -zxvf fping-5.0.tar.gz
# cd fping-5.0/
# ./configure --prefix=/usr/local/fping
# make && make install
# echo 'export PATH=$PATH:/usr/local/tcping/sbin:/usr/local/fping/sbin' >> /root/.bashrc
 
 
 
2.15 CentOS7安装Python3.9
对于CentOS7而言，默认的Python为2.7，普通软件依赖高版本Python，可通过如下方式升级。
# cd /tmp
# pyversion=3.9.9
# wget https://mirrors.huaweicloud.com/python/${pyversion}/Python-${pyversion}.tar.xz --no-check-certificate
# tar -Jxvf Python-${pyversion}.tar.xz
# cd Python-${pyversion}/
# ./configure --prefix=/usr/local/python3 --with-openssl=/usr/local/openssl
# make && make install
# pyversionnew=`echo ${pyversion} | awk -F '.' '{ print $1"."$2 }'`
# cp -brpf /usr/local/python3/bin/{python,pip,pydoc}${pyversionnew} /usr/bin/
# cp -brpf /usr/local/python3/bin/python${pyversionnew}-config /usr/bin/
# pyversionold=`python -V 2>&1 | awk '{ print $2 }' | awk -F '.' '{ print $1"."$2 }'`
# pyversionnew=`echo ${pyversion} | awk -F '.' '{ print $1"."$2 }'`
# mv /usr/bin/python /usr/bin/python.bak
# alternatives --install /usr/bin/python python /usr/bin/python${pyversionold} 30
# alternatives --install /usr/bin/python python /usr/local/python3/bin/python${pyversionnew} 50
# alternatives --auto python
# ln -s /usr/bin/python${pyversionnew} /usr/bin/python3
# ln -s /usr/bin/pip${pyversionnew} /usr/bin/pip3
# ln -s /usr/bin/python${pyversionnew}-config /usr/bin/python3-config3
# echo 'export PATH=$PATH:/usr/local/python3/bin/' >> /root/.bashrc
# source /root/.bashrc
# sed -i '1s/python/python2.7/g' /usr/bin/yum* #仅可执行一次
# sed -i '1s/python/python2.7/g'
/usr/libexec/urlgrabber-ext-down #仅可执行一次
 
提示：对于Python多版本情况下，可能会出现一些依赖性问题，可参考 Python多版本环境管理 ，在系统存在多个版本Python的情况下借助第三方软件进行版本管理和切换。
 
2.16 配置国内pip源
对于Python而言，将pip源修改为国内也非常重要。
 
# mkdir -p ~/.pip
# cat > ~/.pip/pip.conf <<EOF
#[global]
# index-url = https://pypi.mirrors.ustc.edu.cn/simple/
# [install]
# trusted-host = pypi.mirrors.ustc.edu.cn
# EOF
# pip3 install --upgrade pip
# pip install pyreadline#
 
 
=======================================================
 
 
 
 
Dos 攻击防范（自动屏蔽攻击 IP）
#!/bin/bash
DATE=$(date +%d/%b/%Y:%H:%M)
LOG_FILE=/usr/local/nginx/logs/access.log
ABNORMAL_IP=$(tail -n5000 $LOG_FILE |grep $DATE |awk '{a[$1]++}END{for(i in a)if(a[i]>10)print i}')
for IP in $ABNORMAL_IP; do
    if [ $(iptables -vnL |grep -c "$IP") -eq 0 ]; then
        iptables -I INPUT -s $IP -j DROP
        echo "$(date +'%F_%T') $IP" >> /tmp/drop_ip.log
    fi
done
-------------------------------------------------------------------
Linux 系统发送告警脚本
# yum install mailx
# vi /etc/mail.rc
set from=baojingtongzhi@163.com smtp=smtp.163.com
set smtp-auth-user=baojingtongzhi@163.com smtp-auth-password=123456
set smtp-auth=login
 
MySQL 数据库备份单循环
#!/bin/bash
DATE=$(date +%F_%H-%M-%S)
HOST=localhost
USER=backup
PASS=123.com
BACKUP_DIR=/data/db_backup
DB_LIST=$(mysql -h$HOST -u$USER -p$PASS -s -e "show databases;" 2>/dev/null |egrep -v "Database|information_schema|mysql|performance_schema|sys")
 
for DB in $DB_LIST; do
    BACKUP_NAME=$BACKUP_DIR/${DB}_${DATE}.sql
    if ! mysqldump -h$HOST -u$USER -p$PASS -B $DB > $BACKUP_NAME 2>/dev/null; then
        echo "$BACKUP_NAME 备份失败!"
    fi
done
-------------------------------------------------------------------
MySQL 数据库备份多循环
#!/bin/bash
DATE=$(date +%F_%H-%M-%S)
HOST=localhost
USER=backup
PASS=123.com
BACKUP_DIR=/data/db_backup
DB_LIST=$(mysql -h$HOST -u$USER -p$PASS -s -e "show databases;" 2>/dev/null |egrep -v "Database|information_schema|mysql|performance_schema|sys")
 
for DB in $DB_LIST; do
    BACKUP_DB_DIR=$BACKUP_DIR/${DB}_${DATE}
    [ ! -d $BACKUP_DB_DIR ] && mkdir -p $BACKUP_DB_DIR &>/dev/null
    TABLE_LIST=$(mysql -h$HOST -u$USER -p$PASS -s -e "use $DB;show tables;" 2>/dev/null)
    for TABLE in $TABLE_LIST; do
        BACKUP_NAME=$BACKUP_DB_DIR/${TABLE}.sql
        if ! mysqldump -h$HOST -u$USER -p$PASS $DB $TABLE > $BACKUP_NAME 2>/dev/null; then
            echo "$BACKUP_NAME 备份失败!"
        fi
    done
done
-------------------------------------------------------------------
Nginx 访问访问日志按天切割
#!/bin/bash
LOG_DIR=/usr/local/nginx/logs
YESTERDAY_TIME=$(date -d "yesterday" +%F)
LOG_MONTH_DIR=$LOG_DIR/$(date +"%Y-%m")
LOG_FILE_LIST="default.access.log"
 
for LOG_FILE in $LOG_FILE_LIST; do
    [ ! -d $LOG_MONTH_DIR ] && mkdir -p $LOG_MONTH_DIR
    mv $LOG_DIR/$LOG_FILE $LOG_MONTH_DIR/${LOG_FILE}_${YESTERDAY_TIME}
done
 
kill -USR1 $(cat /var/run/nginx.pid)
-------------------------------------------------------------------
Nginx 访问日志分析脚本
#!/bin/bash
# 日志格式: $remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" "$http_x_forwarded_for"
LOG_FILE=$1
echo "统计访问最多的10个IP"
awk '{a[$1]++}END{print "UV:",length(a);for(v in a)print v,a[v]}' $LOG_FILE |sort -k2 -nr |head -10
echo "----------------------"
 
echo "统计时间段访问最多的IP"
awk '$4>="[01/Dec/2018:13:20:25" && $4<="[27/Nov/2018:16:20:49"{a[$1]++}END{for(v in a)print v,a[v]}' $LOG_FILE |sort -k2 -nr|head -10
echo "----------------------"
 
echo "统计访问最多的10个页面"
awk '{a[$7]++}END{print "PV:",length(a);for(v in a){if(a[v]>10)print v,a[v]}}' $LOG_FILE |sort -k2 -nr
echo "----------------------"
 
echo "统计访问页面状态码数量"
awk '{a[$7" "$9]++}END{for(v in a){if(a[v]>5)print v,a[v]}}'
 
-------------------------------------------------------------------
查看网卡实时流量脚本
#!/bin/bash
NIC=$1
echo -e " In ------ Out"
while true; do
    OLD_IN=$(awk '$0~"'$NIC'"{print $2}' /proc/net/dev)
    OLD_OUT=$(awk '$0~"'$NIC'"{print $10}' /proc/net/dev)
    sleep 1
    NEW_IN=$(awk  '$0~"'$NIC'"{print $2}' /proc/net/dev)
    NEW_OUT=$(awk '$0~"'$NIC'"{print $10}' /proc/net/dev)
    IN=$(printf "%.1f%s" "$((($NEW_IN-$OLD_IN)/1024))" "KB/s")
    OUT=$(printf "%.1f%s" "$((($NEW_OUT-$OLD_OUT)/1024))" "KB/s")
    echo "$IN $OUT"
    sleep 1
done
 
-------------------------------------------------------------------
 
-------------------------------------------------------------------
 
监控 100 台服务器磁盘利用率脚本
#!/bin/bash
HOST_INFO=host.info
for IP in $(awk '/^[^#]/{print $1}' $HOST_INFO); do
    USER=$(awk -v ip=$IP 'ip==$1{print $2}' $HOST_INFO)
    PORT=$(awk -v ip=$IP 'ip==$1{print $3}' $HOST_INFO)
    TMP_FILE=/tmp/disk.tmp
    ssh -p $PORT $USER@$IP 'df -h' > $TMP_FILE
    USE_RATE_LIST=$(awk 'BEGIN{OFS="="}/^\/dev/{print $NF,int($5)}' $TMP_FILE)
    for USE_RATE in $USE_RATE_LIST; do
        PART_NAME=${USE_RATE%=*}
        USE_RATE=${USE_RATE#*=}
        if [ $USE_RATE -ge 80 ]; then
            echo "Warning: $PART_NAME Partition usage $USE_RATE%!"
        fi
    done
done
 
-------------------------------------------------------------------
 
 
 
2、批量创建多个用户并设置密码
#!/bin/bash
USER_LIST=$@
USER_FILE=./user.info
for USER in $USER_LIST;do
 if ! id $USER &>/dev/null; then
  PASS=$(echo $RANDOM |md5sum |cut -c 1-8)
  useradd $USER
  echo $PASS | passwd --stdin $USER &>/dev/null
  echo "$USER   $PASS" >> $USER_FILE
  echo "$USER User create successful."
 else
  echo "$USER User already exists!"
 fi
done
 
 
3、一键查看服务器利用率
#!/bin/bash
function cpu(){
  
 util=$(vmstat | awk '{if(NR==3)print $13+$14}')
 iowait=$(vmstat | awk '{if(NR==3)print $16}')
 echo "CPU -使用率：${util}% ,等待磁盘IO相应使用率：${iowait}:${iowait}%"
  
}
function memory (){
  
 total=`free -m |awk '{if(NR==2)printf "%.1f",$2/1024}'`
    used=`free -m |awk '{if(NR==2) printf "%.1f",($2-$NF)/1024}'`
    available=`free -m |awk '{if(NR==2) printf "%.1f",$NF/1024}'`
    echo "内存 - 总大小: ${total}G , 使用: ${used}G , 剩余: ${available}G"
}
disk(){
  
 fs=$(df -h |awk '/^\/dev/{print $1}')
    for p in $fs; do
        mounted=$(df -h |awk '$1=="'$p'"{print $NF}')
        size=$(df -h |awk '$1=="'$p'"{print $2}')
        used=$(df -h |awk '$1=="'$p'"{print $3}')
        used_percent=$(df -h |awk '$1=="'$p'"{print $5}')
        echo "硬盘 - 挂载点: $mounted , 总大小: $size , 使用: $used , 使用率: $used_percent"
    done
  
}
function tcp_status() {
    summary=$(ss -antp |awk '{status[$1]++}END{for(i in status) printf i":"status[i]" "}')
    echo "TCP连接状态 - $summary"
}
cpu
memory
disk
tcp_status
 
 
4、找出占用CPU 内存过高的进程
#!/bin/bash
echo "-------------------CUP占用前10排序--------------------------------"
ps -eo user,pid,pcpu,pmem,args --sort=-pcpu  |head -n 10
echo "-------------------内存占用前10排序--------------------------------"
ps -eo user,pid,pcpu,pmem,args --sort=-pmem  |head -n 10
 
 
5、查看网卡的实时流量
#!/bin/bash
eth0=$1
echo  -e    "流量进入--流量传出    "
while true; do
 old_in=$(cat /proc/net/dev |grep $eth0 |awk '{print $2}')
 old_out=$(cat /proc/net/dev |grep $eth0 |awk '{print $10}')
 sleep 1
 new_in=$(cat /proc/net/dev |grep $eth0 |awk '{print $2}')
 new_out=$(cat /proc/net/dev |grep $eth0 |awk '{print $10}')
 in=$(printf "%.1f%s" "$((($new_in-$old_in)/1024))" "KB/s")
 out=$(printf "%.1f%s" "$((($new_out-$old_out)/1024))" "KB/s")
 echo "$in $out"
done
 
 
6、监控多台服务器磁盘利用率脚本
#!/bin/bash
HOST_INFO=host.info
for IP in $(awk '/^[^#]/{print $1}' $HOST_INFO); do
 #取出用户名和端口
    USER=$(awk -v ip=$IP 'ip==$1{print $2}' $HOST_INFO)
    PORT=$(awk -v ip=$IP 'ip==$1{print $3}' $HOST_INFO)
 #创建临时文件，保存信息
    TMP_FILE=/tmp/disk.tmp
 #通过公钥登录获取主机磁盘信息
    ssh -p $PORT $USER@$IP 'df -h' > $TMP_FILE
 #分析磁盘占用空间
    USE_RATE_LIST=$(awk 'BEGIN{OFS="="}/^\/dev/{print $NF,int($5)}' $TMP_FILE)
 #循环磁盘列表，进行判断
    for USE_RATE in $USE_RATE_LIST; do
  #取出等号（=）右边的值 挂载点名称
        PART_NAME=${USE_RATE%=*} 
  #取出等号（=）左边的值  磁盘利用率
        USE_RATE=${USE_RATE#*=}
  #进行判断
        if [ $USE_RATE -ge 80 ]; then
            echo "Warning: $PART_NAME Partition usage $USE_RATE%!"
    echo "服务器$IP的磁盘空间占用过高，请及时处理" | mail -s "空间不足警告" 你的qq@qq.com
  else
   echo "服务器$IP的$PART_NAME目录空间良好"
        fi
    done
done
 
 
7、批量检测网站是否异常并邮件通知
#!/bin/bash 
URL_LIST="www.baidu.com www.ctnrs.com www.der-matech.net.cn www.der-matech.com.cn www.der-matech.cn www.der-matech.top www.der-matech.org"
for URL in $URL_LIST; do
    FAIL_COUNT=0
    for ((i=1;i<=3;i++)); do
        HTTP_CODE=$(curl -o /dev/null --connect-timeout 3 -s -w "%{http_code}" $URL)
        if [ $HTTP_CODE -eq 200 ]; then
            echo "$URL OK"
            break
        else
            echo "$URL retry $FAIL_COUNT"
            let FAIL_COUNT++
        fi
    done
    if [ $FAIL_COUNT -eq 3 ]; then
        echo "Warning: $URL Access failure!"
  echo "网站$URL坏掉，请及时处理" | mail -s "$URL网站高危" 1794748404@qq.com
    fi
done
 
 
 
8、批量主机远程执行命令脚本
#!/bin/bash
COMMAND=$*
HOST_INFO=host.info
for IP in $(awk '/^[^#]/{print $1}' $HOST_INFO); do
    USER=$(awk -v ip=$IP 'ip==$1{print $2}' $HOST_INFO)
    PORT=$(awk -v ip=$IP 'ip==$1{print $3}' $HOST_INFO)
    PASS=$(awk -v ip=$IP 'ip==$1{print $4}' $HOST_INFO)
    expect -c "
       spawn ssh -p $PORT $USER@$IP
       expect {
          \"(yes/no)\" {send \"yes\r\"; exp_continue}
          \"password:\" {send \"$PASS\r\"; exp_continue}
          \"$USER@*\" {send \"$COMMAND\r exit\r\"; exp_continue}
       }
    "
    echo "-------------------"
done
 
 
 
9、一键部署LNMP网站平台脚本
#!/bin/bash
NGINX_V=1.15.6
PHP_V=5.6.36
TMP_DIR=/tmp
  
INSTALL_DIR=/usr/local
  
PWD_C=$PWD
  
echo
echo -e "\tMenu\n"
echo -e "1. Install Nginx"
echo -e "2. Install PHP"
echo -e "3. Install MySQL"
echo -e "4. Deploy LNMP"
echo -e "9. Quit"
  
function command_status_check() {
 if [ $? -ne 0 ]; then
  echo $1
  exit
 fi
}
  
function install_nginx() {
    cd $TMP_DIR
    yum install -y gcc gcc-c++ make openssl-devel pcre-devel wget
    wget http://nginx.org/download/nginx-${NGINX_V}.tar.gz
    tar zxf nginx-${NGINX_V}.tar.gz
    cd nginx-${NGINX_V}
    ./configure --prefix=$INSTALL_DIR/nginx \
    --with-http_ssl_module \
    --with-http_stub_status_module \
    --with-stream
    command_status_check "Nginx - 平台环境检查失败！"
    make -j 4
    command_status_check "Nginx - 编译失败！"
    make install
    command_status_check "Nginx - 安装失败！"
    mkdir -p $INSTALL_DIR/nginx/conf/vhost
    alias cp=cp ; cp -rf $PWD_C/nginx.conf $INSTALL_DIR/nginx/conf
    rm -rf $INSTALL_DIR/nginx/html/*
    echo "ok" > $INSTALL_DIR/nginx/html/status.html
    echo '<?php echo "ok"?>' > $INSTALL_DIR/nginx/html/status.php
    $INSTALL_DIR/nginx/sbin/nginx
    command_status_check "Nginx - 启动失败！"
}
  
function install_php() {
 cd $TMP_DIR
    yum install -y gcc gcc-c++ make gd-devel libxml2-devel \
        libcurl-devel libjpeg-devel libpng-devel openssl-devel \
        libmcrypt-devel libxslt-devel libtidy-devel
    wget http://docs.php.net/distributions/php-${PHP_V}.tar.gz
    tar zxf php-${PHP_V}.tar.gz
    cd php-${PHP_V}
    ./configure --prefix=$INSTALL_DIR/php \
    --with-config-file-path=$INSTALL_DIR/php/etc \
    --enable-fpm --enable-opcache \
    --with-mysql --with-mysqli --with-pdo-mysql \
    --with-openssl --with-zlib --with-curl --with-gd \
    --with-jpeg-dir --with-png-dir --with-freetype-dir \
    --enable-mbstring --enable-hash
    command_status_check "PHP - 平台环境检查失败！"
    make -j 4
    command_status_check "PHP - 编译失败！"
    make install
    command_status_check "PHP - 安装失败！"
    cp php.ini-production $INSTALL_DIR/php/etc/php.ini
    cp sapi/fpm/php-fpm.conf $INSTALL_DIR/php/etc/php-fpm.conf
    cp sapi/fpm/init.d.php-fpm /etc/init.d/php-fpm
    chmod +x /etc/init.d/php-fpm
    /etc/init.d/php-fpm start
    command_status_check "PHP - 启动失败！"
}
  
read -p "请输入编号：" number
case $number in
    1)
        install_nginx;;
    2)
        install_php;;
    3)
        install_mysql;;
    4)
        install_nginx
        install_php
        ;;
    9)
        exit;;
esac
 
 
10、监控MySQL主从同步状态是否异常脚本
#!/bin/bash 
HOST=localhost
USER=root
PASSWD=123.com
IO_SQL_STATUS=$(mysql -h$HOST -u$USER -p$PASSWD -e 'show slave status\G' 2>/dev/null |awk '/Slave_.*_Running:/{print $1$2}')
for i in $IO_SQL_STATUS; do
    THREAD_STATUS_NAME=${i%:*}
    THREAD_STATUS=${i#*:}
    if [ "$THREAD_STATUS" != "Yes" ]; then
        echo "Error: MySQL Master-Slave $THREAD_STATUS_NAME status is $THREAD_STATUS!" |mail -s "Master-Slave Staus" xxx@163.com
    fi
done
 
 
 
11、MySql数据库备份脚本
分库备份
mysqldump -uroot -pxxx -B A > A.sql
#!/bin/bash
DATE=$(date +%F_%H-%M-%S)
HOST=localhost
USER=backup
PASS=123.com
BACKUP_DIR=/data/db_backup
DB_LIST=$(mysql -h$HOST -u$USER -p$PASS -s -e "show databases;" 2>/dev/null |egrep -v "Database|information_schema|mysql|performance_schema|sys")
  
for DB in $DB_LIST; do
    BACKUP_NAME=$BACKUP_DIR/${DB}_${DATE}.sql
    if ! mysqldump -h$HOST -u$USER -p$PASS -B $DB > $BACKUP_NAME 2>/dev/null; then
        echo "$BACKUP_NAME 备份失败!"
    fi
done
分表备份
mysqldump -uroot -pxxx -A t > t.sql
#!/bin/bash
DATE=$(date +%F_%H-%M-%S)
HOST=localhost
USER=backup
PASS=123.com
BACKUP_DIR=/data/db_backup
DB_LIST=$(mysql -h$HOST -u$USER -p$PASS -s -e "show databases;" 2>/dev/null |egrep -v "Database|information_schema|mysql|performance_schema|sys")
  
for DB in $DB_LIST; do
    BACKUP_DB_DIR=$BACKUP_DIR/${DB}_${DATE}
    [ ! -d $BACKUP_DB_DIR ] && mkdir -p $BACKUP_DB_DIR &>/dev/null
    TABLE_LIST=$(mysql -h$HOST -u$USER -p$PASS -s -e "use $DB;show tables;" 2>/dev/null)
    for TABLE in $TABLE_LIST; do
        BACKUP_NAME=$BACKUP_DB_DIR/${TABLE}.sql
        if ! mysqldump -h$HOST -u$USER -p$PASS $DB $TABLE > $BACKUP_NAME 2>/dev/null; then
            echo "$BACKUP_NAME 备份失败!"
        fi
    done
done
 
 
12、Nginx访问日志分析
#!/bin/bash
# 日志格式: $remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" "$http_x_forwarded_for"
LOG_FILE=$1
echo "统计访问最多的10个IP"
awk '{a[$1]++}END{print "UV:",length(a);for(v in a)print v,a[v]}' $LOG_FILE |sort -k2 -nr |head -10
echo "----------------------"
  
echo "统计时间段访问最多的IP"
awk '$4>="[01/Dec/2018:13:20:25" && $4<="[27/Nov/2018:16:20:49"{a[$1]++}END{for(v in a)print v,a[v]}' $LOG_FILE |sort -k2 -nr|head -10
echo "----------------------"
  
echo "统计访问最多的10个页面"
awk '{a[$7]++}END{print "PV:",length(a);for(v in a){if(a[v]>10)print v,a[v]}}' $LOG_FILE |sort -k2 -nr
echo "----------------------"
  
echo "统计访问页面状态码数量"
awk '{a[$7" "$9]++}END{for(v in a){if(a[v]>5)print v,a[v]}}' $LOG_FILE |sort -k3 -nr
 
 
 
13、Nginx访问日志自动按天（周、月）切割
#!/bin/bash
#nginx日志目录
LOG_DIR=/www/server/nginx/logs
#获取到上一天的时间
YESTERDAY_TIME=$(date -d "yesterday" +%F)
#归档日志取时间
LOG_MONTH_DIR=$LOG_DIR/$(date +"%Y-%m")
#归档日志的名称
LOG_FILE_LIST="access.log"
  
for LOG_FILE in $LOG_FILE_LIST; do
    [ ! -d $LOG_MONTH_DIR ] && mkdir -p $LOG_MONTH_DIR
    mv $LOG_DIR/$LOG_FILE $LOG_MONTH_DIR/${LOG_FILE}_${YESTERDAY_TIME}
done
  
kill -USR1 $(cat $LOG_DIR/nginx.pid)
 
 
14、自动发布Java项目（Tomcat）
#!/bin/bash
DATE=$(date +%F_%T)
  
TOMCAT_NAME=$1
TOMCAT_DIR=/usr/local/$TOMCAT_NAME
ROOT=$TOMCAT_DIR/webapps/ROOT
  
BACKUP_DIR=/data/backup
WORK_DIR=/tmp
PROJECT_NAME=tomcat-java-demo
  
# 拉取代码
cd $WORK_DIR
if [ ! -d $PROJECT_NAME ]; then
   git clone https://github.com/lizhenliang/tomcat-java-demo
   cd $PROJECT_NAME
else
   cd $PROJECT_NAME
   git pull
fi
  
# 构建
mvn clean package -Dmaven.test.skip=true
if [ $? -ne 0 ]; then
   echo "maven build failure!"
   exit 1
fi
  
# 部署
TOMCAT_PID=$(ps -ef |grep "$TOMCAT_NAME" |egrep -v "grep|$$" |awk 'NR==1{print $2}')
[ -n "$TOMCAT_PID" ] && kill -9 $TOMCAT_PID
[ -d $ROOT ] && mv $ROOT $BACKUP_DIR/${TOMCAT_NAME}_ROOT$DATE
unzip $WORK_DIR/$PROJECT_NAME/target/*.war -d $ROOT
$TOMCAT_DIR/bin/startup.sh
 
 
15、自动发布PHP项目
#!/bin/bash
  
DATE=$(date +%F_%T)
  
WWWROOT=/usr/local/nginx/html/$1
  
  
BACKUP_DIR=/data/backup
WORK_DIR=/tmp
PROJECT_NAME=php-demo
  
  
# 拉取代码
cd $WORK_DIR
if [ ! -d $PROJECT_NAME ]; then
   git clone https://github.com/lizhenliang/php-demo
   cd $PROJECT_NAME
else
   cd $PROJECT_NAME
   git pull
fi
  
  
# 部署
if [ ! -d $WWWROOT ]; then
   mkdir -p $WWWROOT
   rsync -avz --exclude=.git $WORK_DIR/$PROJECT_NAME/* $WWWROOT
else
   rsync -avz --exclude=.git $WORK_DIR/$PROJECT_NAME/* $WWWROOT
fi
 
 
16、DOS攻击防范（自动屏蔽攻击IP）
#!/bin/bash
DATE=$(date +%d/%b/%Y:%H:%M)
#nginx日志
LOG_FILE=/usr/local/nginx/logs/demo2.access.log
#分析ip的访问情况
ABNORMAL_IP=$(tail -n5000 $LOG_FILE |grep $DATE |awk '{a[$1]++}END{for(i in a)if(a[i]>10)print i}')
for IP in $ABNORMAL_IP; do
    if [ $(iptables -vnL |grep -c "$IP") -eq 0 ]; then
        iptables -I INPUT -s $IP -j DROP
        echo "$(date +'%F_%T') $IP" >> /tmp/drop_ip.log
    fi
done
17、目录入侵检测与告警
#!/bin/bash
  
MON_DIR=/opt
inotifywait -mqr --format %f -e create $MON_DIR |\
while read files; do
   #同步文件
   rsync -avz /opt /tmp/opt
  #检测文件是否被修改
   #echo "$(date +'%F %T') create $files" | mail -s "dir monitor" xxx@163.com
done

　　

posted @   yuanbangchen  阅读(247)  评论(0)  编辑  收藏  举报
相关博文：
· 分析服务器日志
· 安装Elasticsearch和head与cerebro
· CentOS优化
· Linux Shell脚本经典案例
· CentOS 7 个性化配置指南
阅读排行：
· 全程不用写代码，我用AI程序员写了一个飞机大战
· DeepSeek 开源周回顾「GitHub 热点速览」
· MongoDB 8.0这个新功能碉堡了，比商业数据库还牛
· 记一次.NET内存居高不下排查解决与启示
· 白话解读 Dapr 1.15：你的「微服务管家」又秀新绝活了
点击右上角即可分享
微信分享提示