根据netstat查看进程名、命令行参数、父进程信息等

嗯……遇到了个奇怪的需求：要收集服务器上的LISTEN和ESTABLISHED的连接、PID、进程名、命令行、PPID、父进程名、父命令行

姑且写个脚本来实现吧

Linux的很简单：

#!/bin/sh
#获取输出服务器上LISTEN和ESTABLISHED的连接、PID、进程名、命令行、PPID、父进程名、父命令行


netstat -anpt | grep -i "LIS" | grep -v "127.0.0.1"| grep -v "servers and established" | awk '{print $4,$6,$7}' > /tmp/netstat_tmp.log
while read line
do
	pid=0
	pname="-"
	pcmdline="-"
	ppid=0
	ppname="-"
	ppcmdline="-"

	port=`echo $line|awk '{print $1}'`
	status=`echo $line|awk '{print $2}'`
	pid=`echo $line | awk '{print $3}'|awk -F"/" '{print $1}'`
	if [ $pid -gt 0 ]
	then
		pname=`ps -p $pid | awk '{print $NF}' | tail -n1`
		if [ -f "/proc/$pid/cmdline" ]
		then
			pcmdline=`cat /proc/$pid/cmdline|tr "\0" " "|sed 's/,/ /g'`
		fi
		ppid=`ps -fp $pid |awk '{print $3}'|tail -n1`
		if [ $ppid -gt 0 ]
		then
			ppname=`ps -p $ppid | awk '{print $NF}' | tail -n1`
			if [ -f "/proc/$ppid/cmdline" ]
			then
				ppcmdline=`cat /proc/$ppid/cmdline|tr "\0" " "|sed 's/,/ /g'`
			fi
		fi
	fi
	echo $port,"$status",$pid,"$pname","$pcmdline",$ppid,"$ppname","$ppcmdline"
done < /tmp/netstat_tmp.log

rm -f /tmp/netstat_tmp.log

Windows的话，以前没写过批处理，第一次写，应该还有很多值得改善的地方：

::获取输出服务器上LISTEN和ESTABLISHED的连接、PID、进程名、命令行、PPID、父进程名、父命令行


::关闭命令回显，执行时不显示每条命令的命令行，@表示本行也不显示
@echo off
ver | find "6.1" >nul
if %ERRORLEVEL% == 0 goto ver_2008
ver | find "6.2" > nul
if %ERRORLEVEL% == 0 goto ver_2008
ver | find "5.2" > nul
if %ERRORLEVEL% == 0 goto ver_2008

echo "go exit directly,no version is right"
goto warnthenexit

:ver_2008
:Run Windows Server 2008 specific commands here.
rem echo "2008"
setlocal enabledelayedexpansion
for /f "tokens=2,4,5 delims= " %%i in ('netstat -anop tcp^|find "LIS"^|find /v "127.0.0.1"') do (
	set port=%%i
	set status=%%j
	set pid=%%k
	if  !pid! GTR 0 (
		call :fun !port! !pid! !status!
	)
)
setlocal disabledelayedexpansion
goto exit

:ver_2003
:Run Windows Server 2003 specific commands here.
rem echo "2003"
goto exit

:warnthenexit
echo Machine undetermined.
goto exit

:exit
rem echo "done!"
goto eof

rem 根据pid获取进程名、命令行、PPID,父名称，父命令行的函数
:fun
setlocal enabledelayedexpansion
set port=%1
set pid=%2
set status=%3
if %pid%=="" goto eof
set name="-"
set cmdline="-"
set ppid="0"
set pname="-"
set pcmdline="-"
for /f "usebackq tokens=*" %%a in (`wmic process where processid^=!pid! get caption^,commandline^,parentprocessid /value`) do (
	set "line=%%a"
	set "line=!line:~,-1!"
	if "!line!" GTR "" (
		(echo !line!|findstr -i "Caption">nul)&&(set "name=!line:~8!")
		(echo !line!|findstr -i "CommandLine">nul)&&(set "cmdline=!line:~12!")
		(echo !line!|findstr -i "ParentProcessId">nul)&&(set "ppid=!line:~16!")
		if "!cmdline!" EQU "" (set cmdline="-")
		if !ppid! GTR 0 (
			for /f "usebackq tokens=*" %%u in (`wmic process where processid^=!ppid! get caption^,commandline /value 2^>nul`) do (
				set "line2=%%u"
				set "line2=!line2:~,-1!"
				if "!line2!" GTR "" (
					(echo !line2!|findstr -i "Caption">nul)&&(set "pname=!line2:~8!")
					(echo !line2!|findstr -i "CommandLine">nul)&&(set "pcmdline=!line2:~12!")
					if "!pcmdline!" EQU "" (set pcmdline="-")
				)
			)
		)
	)
)
echo,!port!,!status!,!pid!,!name!,!cmdline!,!ppid!,!pname!,!pcmdline!
setlocal disabledelayedexpansion

:eof

linux和windows的执行效果都如下：

那么，有什么用呢？

传到N台服务器上，每隔一段时间调用一下，拿回来随便处理处理，日常的一些监控、安全操作就都可以简化了。