嗯……遇到了个奇怪的需求:要收集服务器上的LISTEN和ESTABLISHED的连接、PID、进程名、命令行、PPID、父进程名、父命令行
姑且写个脚本来实现吧
Linux的很简单:
#!/bin/sh
#获取输出服务器上LISTEN和ESTABLISHED的连接、PID、进程名、命令行、PPID、父进程名、父命令行
netstat -anpt | grep -i "LIS" | grep -v "127.0.0.1"| grep -v "servers and established" | awk '{print $4,$6,$7}' > /tmp/netstat_tmp.log
while read line
do
pid=0
pname="-"
pcmdline="-"
ppid=0
ppname="-"
ppcmdline="-"
port=`echo $line|awk '{print $1}'`
status=`echo $line|awk '{print $2}'`
pid=`echo $line | awk '{print $3}'|awk -F"/" '{print $1}'`
if [ $pid -gt 0 ]
then
pname=`ps -p $pid | awk '{print $NF}' | tail -n1`
if [ -f "/proc/$pid/cmdline" ]
then
pcmdline=`cat /proc/$pid/cmdline|tr "\0" " "|sed 's/,/ /g'`
fi
ppid=`ps -fp $pid |awk '{print $3}'|tail -n1`
if [ $ppid -gt 0 ]
then
ppname=`ps -p $ppid | awk '{print $NF}' | tail -n1`
if [ -f "/proc/$ppid/cmdline" ]
then
ppcmdline=`cat /proc/$ppid/cmdline|tr "\0" " "|sed 's/,/ /g'`
fi
fi
fi
echo $port,"$status",$pid,"$pname","$pcmdline",$ppid,"$ppname","$ppcmdline"
done < /tmp/netstat_tmp.log
rm -f /tmp/netstat_tmp.log
Windows的话,以前没写过批处理,第一次写,应该还有很多值得改善的地方:
::获取输出服务器上LISTEN和ESTABLISHED的连接、PID、进程名、命令行、PPID、父进程名、父命令行
::关闭命令回显,执行时不显示每条命令的命令行,@表示本行也不显示
@echo off
ver | find "6.1" >nul
if %ERRORLEVEL% == 0 goto ver_2008
ver | find "6.2" > nul
if %ERRORLEVEL% == 0 goto ver_2008
ver | find "5.2" > nul
if %ERRORLEVEL% == 0 goto ver_2008
echo "go exit directly,no version is right"
goto warnthenexit
:ver_2008
:Run Windows Server 2008 specific commands here.
rem echo "2008"
setlocal enabledelayedexpansion
for /f "tokens=2,4,5 delims= " %%i in ('netstat -anop tcp^|find "LIS"^|find /v "127.0.0.1"') do (
set port=%%i
set status=%%j
set pid=%%k
if !pid! GTR 0 (
call :fun !port! !pid! !status!
)
)
setlocal disabledelayedexpansion
goto exit
:ver_2003
:Run Windows Server 2003 specific commands here.
rem echo "2003"
goto exit
:warnthenexit
echo Machine undetermined.
goto exit
:exit
rem echo "done!"
goto eof
rem 根据pid获取进程名、命令行、PPID,父名称,父命令行的函数
:fun
setlocal enabledelayedexpansion
set port=%1
set pid=%2
set status=%3
if %pid%=="" goto eof
set name="-"
set cmdline="-"
set ppid="0"
set pname="-"
set pcmdline="-"
for /f "usebackq tokens=*" %%a in (`wmic process where processid^=!pid! get caption^,commandline^,parentprocessid /value`) do (
set "line=%%a"
set "line=!line:~,-1!"
if "!line!" GTR "" (
(echo !line!|findstr -i "Caption">nul)&&(set "name=!line:~8!")
(echo !line!|findstr -i "CommandLine">nul)&&(set "cmdline=!line:~12!")
(echo !line!|findstr -i "ParentProcessId">nul)&&(set "ppid=!line:~16!")
if "!cmdline!" EQU "" (set cmdline="-")
if !ppid! GTR 0 (
for /f "usebackq tokens=*" %%u in (`wmic process where processid^=!ppid! get caption^,commandline /value 2^>nul`) do (
set "line2=%%u"
set "line2=!line2:~,-1!"
if "!line2!" GTR "" (
(echo !line2!|findstr -i "Caption">nul)&&(set "pname=!line2:~8!")
(echo !line2!|findstr -i "CommandLine">nul)&&(set "pcmdline=!line2:~12!")
if "!pcmdline!" EQU "" (set pcmdline="-")
)
)
)
)
)
echo,!port!,!status!,!pid!,!name!,!cmdline!,!ppid!,!pname!,!pcmdline!
setlocal disabledelayedexpansion
:eof
linux和windows的执行效果都如下:
那么,有什么用呢?
传到N台服务器上,每隔一段时间调用一下,拿回来随便处理处理,日常的一些监控、安全操作就都可以简化了。