Linux Training

#!/bin/sh
# $Id: roguehunter,v 1.13 2017/07/10 19:17:22 fulford Exp $
# $Source: /src/bfl/usr/local/etc/RCS/roguehunter,v $
# $Revision: 1.13 $
# Author C W Fulford.
# Copyright 2016 (c) C W Fulford.
# Licensed for public use under the LGPL, .
# For assistance contact fulford@fulford.net 0793 572 8612
########################################################################
cmd=`basename $0`
ver=`echo "$Id: roguehunter,v 1.13 2017/07/10 19:17:22 fulford Exp $"|awk '{print $3,$4,$5}'`
syntax="$cmd [-c <configfile>] [-d] [-v]|-V"
while [ $# -gt 0 ] ;do
	case $1 in 
		-d) set -x;debug=0;shift;;
		-m) max=$2;shift 2;;
		-v) verbose=:;shift;;
		-V) echo "$cmd $Revision: 1.13 $ $Date: 2017/07/10 19:17:22 $"|awk '{print $1,$3,$6}';exit;;  
		*) echo $syntax >&2;exit;;
	esac
done
ignore="init|nfsd|nmbd|sysproc|_upsd"
log=/var/log/$cmd`date +%w`
max=${max:-50}
[ $verbose ] && echo "$cmd: max = $max" >&2
date=`date "+%b %d"`
ls -l $log |grep -q "$date" || >$log
if [ "$debug" ];then
	echo -n "logfile = `ls -l $log`"
fi
rogues=/tmp/$cmd$$ ;touch $rogues

# NB can't use -ef as UnixWare has irregular number of fields
ps -e |egrep -v "$ignore"|
awk 'NR > 1 {
        split($5,a,":")
        if(a[1] >= '$max') {
                if ($6 ~ /smn12/) print $1 >> "'$rogues'"
                else if($6 ~ /nfsd/) nfs=true    
                else print "check",$6,$1,a[1] >>"'$log'"
        }
}'
n=`cat $rogues | wc -l`
if [ $n -gt 0 ];then
	cat $rogues |
	while read pid ;do
	       	ps -ef |
		# get the parent process if its not init and add to
		# the rouges list
		awk '$2 == '$pid' && $3 > 1 {
			print $3 >>"'$rogues'"
		}'
	done
fi
[ "$verbose" ] &&{
	cat $rogues >&2
}
cat $rogues | 
while read pid ;do
	[ $verbose ] && echo $pid >&2
	ps -eo "pid ppid comm" |
	awk '{
		if($1=='$pid' && (($3 ~ /smn12/)||($2==1 && $3 ~ /ksh/))){
			printf("%s %i %s ","killing",$1,$3) >>"'$log'"
			# No time functions available in this awk
			cmd="/bin/ksh >> '$log'"
			print "date" | (cmd)
			close(cmd)
			cmd="xargs kill"
			print $1 |(cmd)
			close(cmd)
			#print $1
		}
	}' 
done 
rm $rogues
######################################################################
# This program is free software: you can redistribute it and or      #
# modify it under the terms of the Lesser GNU General Public License #
# as published by the Free Software Foundation, either version 3 of  #
# the License, or (at your option) any later version.                #
#                                                                    #
# This program is distributed in the hope that it will be useful,    #
# but WITHOUT ANY WARRANTY; without even the implied warranty of     #    
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the      #
# GNU General Public License for more details.                       #
#                                                                    # 
# A copy of the Lesser GNU General Public License and the GNU        #
# General Public License is available at                             #
# <http://www.gnu.org/licenses/>.                                    #
######################################################################