linux系统-统计连接数-钉钉告警

一、脚本

## vi tongji.sh
#!/bin/bash
WEBHOOK_URL="https://oapi.dingtalk.com/robot/send?access_token=c8811248e64dc396fb73axxxx"
SECRET="SECf3e9d08c42dfff13091xxxxxxxxxxx"

get_server_ip() {
  local ip=$(ip -4 addr show|grep -oP '(?<=inet\s)\d+(\.\d+){3}' | grep -v '^127\.' |head -1)
  echo "$ip"
}
send_dingtalk(){
  local message="$1"
  local timestamp=$(date +%s%3N)
  local request_url="$WEBHOOK_URL"
  if [ -n "$SECRET" ];then
    local string_to_sign="${timestamp}"$'\n'"${SECRET}"
    local sign=$(echo -n "$string_to_sign" | openssl dgst -sha256 -hmac "$SECRET" -binary | base64)
#    local sign=$(echo -n "$string_to_sign" | openssl digest -sha256 -hmac "$SECRET" | base64)
    sign=$(echo -n "$sign" | xxd -plain | tr -d '\n' | sed 's/\(..\)/%\1/g')
    request_url="${WEBHOOK_URL}&timestamp=${timestamp}&sign=${sign}"
  fi
  local payload=$(cat <<-EOF
{
  "msgtype": "markdown",
  "markdown": {
    "title": "连接告警",
    "text": "${message}"
  },
  "at": {
    "isAtAll": false
  }
}
EOF
)
  curl -s -H "Content-Type: application/json" -d "$payload" "$request_url"
}

check_connections() {
  local threshold=500
  local server_ip=$(get_server_ip)
  local conn_count=$(netstat -tlan | wc -l)
  conn_count=$(echo "$conn_count" | tr -d ' ')
  if [ "$conn_count" -gt "$threshold" ]; then
    local alert_msg="#### 服务器连接数告警\n\n"
    alert_msg+="- **服务器IP**: \`${server_ip}\`\n"
    alert_msg+="- **当前连接数**: **${conn_count}**\n"
    alert_msg+="- **告警阈值**: ${threshold}\n"
    alert_msg+="- **出发时间**: `date '+%Y-%m-%d %H:%M:%S'`\n\n"
    local tcp_stats=$(netstat -tlan | awk 'NR>2 {print $6}' | sort | uniq -c | awk '{printf "- %s: %s\\n", $2, $1}')
    if [ -n "$tcp_stats" ]; then
      alert_msg+="**连接状态统计**: \n${tcp_stats}\n"
    fi
    alert_msg+="\n**TOP 5 连接IP**: \n"
    local top_ips=$(netstat -tlan | awk 'NR>2 {print $5}' | grep -oE '([0-9]{1,3}\.){3}[0-9]{1,3}' | sort | uniq -c | sort -rn | head -5 | awk '{printf "- %s (%s)\\n", $2, $1}')
    if [ -n "$top_ips" ]; then
      alert_msg+="$top_ips"
    else
      alert_msg+="- 无外部链接"
  fi
  send_dingtalk "$alert_msg"

  echo "[$(date '+%Y-%m-%d %H:%M:%S')] 告警出发 - IP: $server_ip, 连接数: $conn_count" >> /var/log/connection_alert.log
fi
}
check_connections

二、测试

sh -x tongji.sh

三、效果

四、任务计划

crontab -e

*/30 * * * * /usr/bin/bash /opt/scripts/tongji.sh