netstat script

[Ku]

Hi,

Does anyone have a script which will do netstat into all servers listed on a file and create a list with server names and all established port details.

or in other way, a script to login to all servers and capture the o/p of 'netstat -avtn |grep -i established' in single file with server names

Thanks in advance

[Patrick Wallek]

Do you have SSH set up so that you can log into each server without providing a password?  If not, that is the first step.

If you do have SSH set up for passwordless logins, then something like this ought to get you started:

# netstat-script.sh

#!/usr/bin/sh

for SERV in $(< /dir/list-of-servers)

do

echo ${SERV}

ssh ${SERV} "netstat -avn |grep -i established"

echo ""

done > /dir/netstat-script.out

I remove the 't' option from your netstat command as that is not a valid option on HP-UX.

Your file with the list of servers in it should have one server name per line.

# cat list-of-servers
atl1
atl2
atl3

You will also need to modify the directory names and file names to suit you, but this should get you started.

[Ku]

Hi,

Thanks for the reply.. Issue is I dont have passowrdless ssh in place.  Also I dont have single password on all servers. i have around 3 different root passwords on different serevrs. So is there any way that I can put all these three password in one file and have the script to read that one by one.?

Thanks

[Patrick Wallek]

Ahh...In this case you would have to use something like Expect to write your script.  You can have conditions in Expect so that should allow you to try different passwords.

I don't have any examples of an Expect script.  Perhaps some of the other folks here.

[Dennis Handly]

>should have one server name per line.

Actually with $(< file), you don't need them one per line.

But if you ever want to switch to "while read server" you would.

[Bill Hassell]

When you don't have a single method to transfer files (ssh is very powerful for this purpose), I use batch ftp rather than Expect. Expect can be a challenge to install and use, whereas ftp can be controlled with a simple 'here document'  with the appropriate commands (including open, user and password).

Here's a simple example. Because these commands can be assigned to a variable, you can design your netstat gathering script to capture your data in a local file on each server and then transfer it to your central server on request or perhaps by cron. This is for a one time copy. Each run will overlay the previous run's file.

#!/usr/bin/sh
set -u
# Script to capture netstat/established data
# Customize with USER, PW for the collector system
# Local file is stored in the same location at the collector

LOGIN=guest
PW=guest1234
COLLECTOR=server1

MYHOST=$(hostname)
TEMPFILE=/tmp/$MYHOST-netstat.tmp
DATESTAMP=$(date '+%Y-%m%d')
echo "$MYHOST - $DATESTAMP\n$(netstat -avn |
     grep -i established)" > $TEMPFILE

ftp -n -v $COLECTOR << EOF
  user $LOGIN $PW
  ascii
  put $TEMPFILE $TEMPFILE
  chmod 600 $TEMPFILE
  bye
EOF

rm -f $TEMPFILE

By having the script run on each server, no login/password list is needed. And since netstat can be run by any user, there is much better security by creating an ordinary user to run the script on each system.