
Recently, there was a need for periodic monitoring of servers for the fall of some services
(read ports) and the notification of the admin (those of me) when an error occurs.
Solution - under the cut
So that we are several servers, a bunch of ports. we check the port for openness classically - by nmap
example output:
firewall:~/scripts# nmap 192.168.1.1 -p3389
Starting Nmap 4.11 ( www.insecure.org/nmap ) at 2009-05-06 14:54 GMT-4
Interesting ports on 192.168.1.1:
PORT STATE SERVICE
3389/tcp open ms-term-serv
MAC Address: 00:50:8D:EB:7E:08 (Abit Computer)
Nmap finished: 1 IP address (1 host up) scanned in 0.132 seconds
this means that the terminal server is up, and most likely it works :)
if instead of open something different is written - accordingly the joint, it is necessary to inform.
')
Long came up with a message system. Came from the hardest - to the simplest. A bee-mail has such a mailtosms service, if you send a letter to a box in the format 890912345678@sms.beemail.ru, then it will suit the SMS containing the text of the letter.
So the task is to scan everything from the list of servers and ports and write everything in a separate file and send it to us for soap.
what happened:
#! / bin / bash
for a in $ ( < servers ) ; do nmap ` echo $ a | sed -e 's /: / -p /' ` | grep -q "/ tcp * open" || echo $ a ; done > / var / test / serverlist;
DATENOW = $ ( date + % d- % m- % Y_ % T )
if ( ! ( [ -z $ ( cat / var / test / serverlist ) ] ) ) ; then
echo $ DATENOW >> / var / test / log
cat / var / test / serverlist >> / var / test / log
mail 7909 ******* @ sms.beemail.ru < / var / test / serverlist
fi
exit
How it works?
we create the
servers file, we lay down near the script itself.
The content of the
servers file is like this:
192.168.1.1:80
192.168.1.2:25
192.168.1.3:110
Well, in general, I understand
sed command
-e 's /: / -p /' ` replaces": "with" -p "
for a in $ (<servers); do nmap `echo $ a | sed -e 's /: / -p /' ` - feeds the results to nmap
grep -q "/ tcp * open" || echo $ a; done> / var / test / serverlist; - tears out lines if the port is not open and pushes them into the
serverlist file
after which the file is checked for the presence of something in it and if there is something there, it is written to the log (for debugging) and sent to the soap / telephone of the administrator.
voila. add to crontab, once an hour (so as not to strain) and use
ZYZH I know that there are things like nagios and other network monitors, but they are too powerful and difficult to configure when it is enough just to scan the ports of several servers.