topic Re: Some Scripting help in Operating System - HP-UX

Some Scripting help

Joyce Suganthy — Tue, 02 Sep 2003 00:45:13 GMT

Hi All,

Need a favour, I am in the midst of planning to write a script that will send a mail everytime the size or the permission or the timestamp or the owner or the group of a file changes. Any idea how this can be done, as I have many files to monitor for changes.

Thanks a lot

regards

Re: Some Scripting help

Tim Adamson_1 — Tue, 02 Sep 2003 01:23:34 GMT

You would need something to compare it against in the firstplace.

Maybe write a script that collects the required information for each file and stores it somewhere and can be the "master" file.

Then your script can collect the information again, save it in a temporary file and you can use diff or comm to compare the original with the current and report any differences.

Just an idea.

Tim

Re: Some Scripting help

Rob_132 — Tue, 02 Sep 2003 01:32:45 GMT

Create a baseline (run once, interactively):

for a in file1 file2 file3 file4
do
ll $a >> /tmp/Last.ll
done

Then your compare script, in a cron:

for a in file1 file2 file3 file4
do
ll $a >> /tmp/Now.ll
done

> Diff.ll
Ch=`diff /tmp/Last.ll /tmp/Now.ll|wc -l`
if [ $Ch !ne "0"]
then
diff /tmp/Last.ll /tmp/Now.ll >> Diff.ll
mailx -f "/tmp/Diff.ll" you@here.com
cp /tmp/Now.ll /tmp/Last.ll
fi

****

Final debug/tweaks up to you - I cannot get to my UX server right now....

Hope this helps!
Rob

Re: Some Scripting help

Rob_132 — Tue, 02 Sep 2003 01:35:56 GMT

...the best way to proof-read something is to FIRST send it to the world.... Try this instead as the compare script.

Rob

****

Then your compare script, in a cron:

> /tmp/Now.ll
for a in file1 file2 file3 file4
do
ll $a >> /tmp/Now.ll
done

> /tmp/Diff.ll
Ch=`diff /tmp/Last.ll /tmp/Now.ll|wc -l`
if [ $Ch !ne "0"]
then
diff /tmp/Last.ll /tmp/Now.ll >> /tmp/Diff.ll
mailx -f "/tmp/Diff.ll" you@here.com
cp /tmp/Now.ll /tmp/Last.ll
fi

Re: Some Scripting help

Bhuvaneswari Selvaraj — Tue, 02 Sep 2003 03:33:27 GMT

A small script like the following should do:

script: (Assuming that u save it as "script" )

while read i
do
a=`echo $i | awk '{print $9}'`
b=`ll $a`
if [[ $b != $i ]]
then
echo $a "has changed"
fi
done

test file: (assuming that u ssave it as "test" )
-r-xr-xr-x 1 bin bin 1415 Jul 24 06:10 .profile
-rw------- 1 root root 22 Aug 27 06:08 .rhosts
-rw------- 1 root sys 6014 Sep 2 00:03 .sh_history
-rw-rw-rw- 1 root sys 0 Jul 25 01:25 devnull
-rw-rw-rw- 1 root sys 1043 Jul 14 08:14 mbox
-rwxrwxrwx 1 root sys 107 Sep 2 00:02 script
-rw-rw-rw- 1 root sys 0 Sep 2 00:03 test
-rwxrwxrwx 1 root sys 32768 Jul 21 08:28 trapd
-rw-r----- 1 root sys 6796 Jul 21 08:27 trapd.c

This the ll output of the files that you want to montior. Ensure that the file name is a fully qualified filename with the full path. Do a ll of the files that you want to monitor from the '/' dir and save them sequentially in the test file.

Now execute this as
./script < test
(I assume that script & test are in the same dir, if not, invoke them with the proper full path of both)

Put this script in cron and execute this to send a mail to you...

echo $a "has changed" - You can change this to mailx command to have the script mail to you...

Re: Some Scripting help

hein coulier — Tue, 02 Sep 2003 06:15:47 GMT

there's also a product named 'tripwire' that provides this functionality (if my memory serves me well).

Re: Some Scripting help

TOMAS BERNABEU — Tue, 02 Sep 2003 06:25:44 GMT

use find . example :

find $PATH -cmin -1 -print 1>/tmp/files.txt

use cron avery minute for this example, and you can add mail command to send file content.

Tom

Re: Some Scripting help

john korterman — Tue, 02 Sep 2003 09:07:31 GMT

Hi,

as already said, you need a file list for comparison, e.g. this three-lined example:

-rw-r--r-- 1 jxk users 8 Sep 2 11:14 /tmp/jxk/flipflip
-rw-rw-rw- 1 root sys 16 Sep 2 11:14 /home/jxk/flipflap
-rw-r--r-- 1 jxk users 33 Sep 2 11:15 /home/jxk/blipblop

The attached script can make use of a list like the above. Admitted, the script is a bit crude, as it only echoes when you need to do some sendmail activity.
The script will also react to differences in link numbers (unrequested), and the file list is updated every time: not particularly practical, but may serve as a starting point.

regards,
John K.

Re: Some Scripting help

Hai Nguyen_1 — Tue, 02 Sep 2003 13:49:34 GMT

You can use HP proprietary commands mkpdf to build a base line and pdfck to compare the base line against the current state of the system. man mkpdf and pdfck for more info and examples.

Hai

Re: Some Scripting help

Joyce Suganthy — Fri, 05 Sep 2003 03:00:39 GMT

Hi All,

Thanks for the help

John,
I have followed your way or finding the difference, but the script also gives the email alert if there is a difference in size change for a particular file, how do i check only change is the file permission, user and group... please help

Re: Some Scripting help

Ollie R — Fri, 05 Sep 2003 04:50:42 GMT

Hi Joyce,

If you want a full-blown intrusion detection system, take a look at IDS/9000 which is available from HP for free:
http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProductInfo.pl?productNumber=J5083AA

If your requirement does not justify such fuss, then modify the scripts the others have suggested to run the appropriate command. Most of your information is available using the "ll" command. Other then this, you might have to write a little perl routine or shell script to get exactly what you're looking for.

Hope this helps,

Ollie.

Re: Some Scripting help

john korterman — Fri, 05 Sep 2003 07:26:28 GMT

Hi again Joyce,

the modified, attached script looks only at permissions, user, and group. It assumes that these three items of information are present in $FILENAME in the mentioned order, followed by full_path_filename. Example of three lines from $FILENAME:

-rw-r--r-- jxk users /tmp/jxk/flipflip
-rw-rw-rw- root sys /home/jxk/flipflap
-rw-r--r-- jxk users /home/jxk/blipblop

Empty lines are not permitted in $FILENAME.
However, I would not base my career on this script. Where are the perl one-liners?

regards,
John K.

Re: Some Scripting help

Joyce Suganthy — Tue, 09 Sep 2003 06:54:36 GMT

thanks alot for all of your help. I managed...