favorite sysadmin scripts you always keep around [2]

[Kevin Tuitt]

search: a useful utility for searching the passwd file.

usage: search [string] [string]
or simply type search and follow the prompts

Note: to prevent an extreme amount of results being returned a little thought is needed e.g. don't do:

search bin

unless you want almost every account being returned (/usr/bin/sh)

You may need to amend the email section for your particular site. Sample output provided below:

# search uitt

Account Name : Im_not_that_foolish
Real Name : Kevin Tuitt
Tel. : +44 ##### #####
Location : Bracknell
email : kevin.tuitt@cit.com
UID : ###
GID : ###
Home Dir. : /home/Im_not_that_foolish
Shell : /usr/bin/sh

[Doug Burton]

This isn't a script but can be used as a ref for scripts (see my next post for a strange color ll command). This beast refs prompt text and background color.

Example: Put this in your .logout file. Start a DTterm while in CDE and exit out....

if [[ $TERM = dtterm ]]
then

function blah {
echo "\\033[40m\\033[31m"
banner Hey!
echo "\\033[40m\\033[35m"
echo "\n\n You just logged me out. \n\n"
echo " Now I feel bad. \n\n"
echo "\\033[0m"
sleep 2
}
blah

else

banner Hey!
echo "\n\n You just logged me out. \n\n"
echo " Now I feel bad. \n\n"
sleep 2

fi

Pretty colors......

[Doug Burton]

A goofy way to run ll and have files, dirs and links in dif colors. Kinda like linux/bash I guess.

More pretty colors......

[Doug Burton]

Run "killit", it'll ask for process to kill. Put in your user id. It asks if you really want to kill -9 them.

[Doug Burton]

A funky script to generate a host file.

Edit the file with a subnet number. It will nslookup every number from (example) 10.10.10.1 - 255 and make a /tmp/host file with whatever returned. Like all my stuff, it could have been done better so feel free to tear it up.

[Doug Burton]

Last one. Check for UID zero users.

[Tom Danzig]

This little quicky shows who successully and unsuccessfully su'ed to root. Useful to find out who's hacking and who knows the root pwd:

#!/usr/bin/sh
echo " "
echo "Failed su to root"
echo "-----------------"
awk '/-root$/&&$8~/^-$/{split($NF,a,"-");print a[1]}' /var/adm/syslog/syslog.log | sort -u
echo " "
echo "Successful su to root"
echo "---------------------"
awk '/-root$/&&$8~/^\+$/{split($NF,a,"-");print a[1]}' /var/adm/syslog/syslog.log | sort -u
echo " "

[Tom Danzig]

I find this one really helpful in finding a date a certain number of days ago. I use it in conjunction with a scripts that parse the syslog to only get recent messages. Multiple outputs for use with OmniBack, etc are also supported (see script).

Pardon the use of csh which WAS my shell of choice years ago.


Tom

[Donny Jekels]

date manipulation inside a ksh script can be tricky.

I find myself using this script in all my tools.

usaully jobs are scheduled from cron and then work on log files the the next day. however date the filename is tricy cause if you read the system date, then you get the surrent day which is not correct for the output file. since the output file contains yesterdays date.

see date2julian and how I use it in a checkpoint installtion on my HP firewall.

it is bacomes even more tricy when you change months, years etc. thsi script helps with all those issues. I love it.

[Kevin Tuitt]

script to generate a daily audit log of who is logging onto your server.

Reports both successful and failed logins for su, telnet, remshd, rexec, ftp (you will need to configure ftpd logging to see what files have been ftp'd), console and boot.

Configure mail on your server and it mail you the flat file results with a Microsoft Word attachment.

Run from cron it's an invaluable first line security checker.

Includes an option for you to report on historic access ( -d ). The ftpd component is not configured to report historically so cron it before midnight if you need to see this info.

[David Christensen]

Here's a perl script that gives me a quick look at what's going on (make sure my servers are up, the backup ran, etc). I have my .profile run it.

[Jack C. Mahaffey]

Here's a script I use to periodically ping entries in the /etc/hosts file. It's called ping_etc_hosts.sh It will make three attempts.

[Joe Steele]

used to replace a certain string in a file-list. basically just provides a shell for sed - for the leyman user.

[Keely Jackson]

Hi Bill

As we don't have glance on all machines, here is a cobbled together shell/awk script to collate basic performance stats over a daily and monthly period.

Cheers
Keely

[edwin hamers]

Haribol!

These two scripts provided a means to keep filesystems
clean of annoying log files, AND to set up a round robin
for usefull log files.

Script 1 : wissel_log.sh : round robin script
wissel_log.cfg : config file

Script 2 : delfile.sh : delete script
delfile.cfg : config file

You can add as many logfiles/dirs as you like, which will
be rotated/delete on a configurable time basis.

Plug these scripts into the cron, preferably
in the following order :
30 23 * * * /home/rocdb/sbin/wissel_log.sh
45 23 * * * /home/rocdb/sbin/delfile.sh.

It would be even more 'secure' to start the delfile script
AFTER the backup is succeeded.

...ET...

[Kevin Tuitt]

A script to replicate the spooler configuration (all configured lp printers) from one server to any other(s).

Useful in environments where you need to have the same printers configured across all servers. Uses the un-documented (there's no man page) sam utility of /usr/sam/lbin/lpmgr

run it from your "master" server and input hostnames for your site as appropriate.

[Jack C. Mahaffey]

-- checkin_snapshot.sh
--
Here's something I use quite often. It's a wrapper for RCS. It uses another utility called getchmod to get chmod permissions.

I have two versions of the utility. This one is called checkin_snapshot.sh. The other is named checkin.sh.

checkin_snapshot.sh uses RCS to checkin source files to the RCS subdirectory. It also resets the permissions and original ownership. A default message is saved on the checkin.
It does:
ci -l
chmod nnn
chown nnn

RCS has a nasty habit of changing the permissions when it checks in a file. This fixes the problem.

I'll send getchmod in a separate reply.

[John Meissner]

this is a script called "pig" that will work on either Unix or linux which uses ping but reports each server in solaris format as "alive" or "dead"

useage: pig

[John Meissner]

I use this script to monitor all my servers. It tells me if any of them go down - it runs like a monitoring window. it uses a file which you need to create called "serverlist" which contains a listing of all your servers you want to monitor.

[John Meissner]

This script will look at a file called "serverlist" which contains a list of all your servers and ftp's a file you specify in the script out to all the servers in the list.

[TwoProc]

These are some scripts that are great by themselves, and form that basis for other programs that I'll submit (lvmwatch,drivelist,morning).

These programs stand on their own, as useful items, but be aware that they tend to call each other for information. These programs assume that the dependent scripts are located in "/home/adm/bin", so you'll have to change these where applicable to your system's preferred admin scripting area.

Most of these I've generated to give a "quick list" of what I've got in hardware and their status on the system. These scripts give a nice standalone output, but the output is short enough (sans headers and the like) to be used as input into others scripts. I use them as input for a "morning checkout" of my systems each day.

There are three types of scripts: for logical volumes, for physical volumes, and for volume groups. Of these there are two types - one each for a list, and one each for a "status" (like "available", "syncd", etc).

lvlist - list logical volumes
lvstat - list lv's and give status

pvlist - list physical volumes
pvstat - list pv's and give status

vglist - list volume groups
vgstat - list vg's and give status

[TwoProc]

Drivelist program

Gives a two-column listing of drives in your system.

First column is hardware path, second column is /dev/dsk/cxtxdx path.

Expects /home/adm/bin/pvlist (from prior posting) to be there to run.

Suitable for calling from your own scripts to establish systems checks, etc.

[TwoProc]

Sorry about that - this is the second one of the day that I posted without the attachment. Here's the attachment: please excuse the really redundant oversight (duhhh).

LVMWATCH -
This is a cool program I wrote to watch and observe lvm rebuilds. Use this when you've got lvm volumes that are being mirrored and you want to watch the mirrors being built as they happen.

If you've got an lvm mirror being built, or that is resyncing after a "stale" event, you can observe it just by typing "lvmwatch".

No arguments are needed!

It automatically knows which logical volumes are in the build/rebuild stage, and it gives you information about those processes.

If no lvm builds/rebuilds are in process it lets you know.

[TwoProc]

... Forgot to mention in the above message: the "lvmwatch" script depends on "lvlist" script existing in /home/adm/bin. This script is posted in one of the above prior postings. You can of course easily change where the script points to (that is, your own administrative scripts directory).

[TwoProc]

STATCK:

I use this as a "morning" checkout of my systems. It relies on /home/adm/bin/lvstat and /home/adm/bin/pvstat being installed. You can change the "$ADM_BIN" variable at the top of the script to have it point to your own administrative script area. If you're going to use this script you'll have to download the scripts mentioned from one my previous postings.

If you make a symbolic or hard link to the script (save the original as "statck"), as 1) "statcki" or 2) "statckp" you'll get slightly different output.
"statck" gives you the output straight to the screen unpaginated. "statcki" gives you the same output, but will "paginate" the output via "more" and "any key to continue", etc. "statckp" is the same output formatted to go on a printer (has line feeds - ctrl-l's).

This is good program to mail out to your admins and operators each morning to see how your system is doing.

The first section is:
Disk Utilization sorted by percent utilization

Second section is:
Disks Over 90% Full

Third Section:
Physical Volume Status
(hardware addr,device name, status)

Fourth Section:
Logical Volume Status
(logical volume,status, mountpoint)

Fifth Sectin:
Swap Info:

I've seen some other good ones here posted, and I'll be reviewing those to add to what this has (specifically the ones that go over the messages logs), you may want to do the same.