Help on scripting monitoring usage

[Paula J Frazer-Campbell]

Hi
Not being a scripting expert I require help to produce a script.
History:-
These users are x25 connections which I push up and give a id of vdx.
We have over 12000 connections of this type/day.
I require to monitor their connection time and cpu time and automatically kill high usage of each.
I have got this far where I pick up the info I require but how to monitor / manipulate and kill is my problem.

ps -ef|grep " vdx"|awk '{print $2}' #PID
ps -ef|grep " vdx"|awk '{print $5}' #Time on
ps -ef|grep " vdx"|awk '{print $7}' #CPU Time


Any help gratefully received.

BTW - Happy new year to all - I hope you had a good one.

Paula

[Dan Hetzel]

Hi Paula,

My 2 cents:

ps -ef|grep " vdx"| grep -v grep|awk '{print $2}' #PID
would prevent to report the PID of the grep process itself

When using awk '{print $5}' for the time, are you sure that time is less than 1 day ? Otherwise, ps will report a date and $5 will be the month.

Best regards,

Dan

[Sandor Horvath_2]

Hi !

Use in sh:

export UNIX95=
ps -C vxd -o "pid cpu stime" | tail + 2

regards, Saa

[Paula J Frazer-Campbell]

Hi Dan
Thanks for this - user connection will never get anywhere near 1 day as I have auto logout at 240 seconds idle time.
What I am trying to prevent automatic screen scraping which incurs a costing to the company as we pay for successful connections to us.

We are a Flight Only travel company and our competition tries to scan our prices via this x25 connection.
So if they are successful they get our prices quickly and we end up paying for their call !!!


Paula

[Dan Hetzel]

Hi Paula,

Isn't there any other way to prevent your competition to log in using X25?
Maybe they need to log in for other reasons?

If I understand correctly, you'd like to kill an X25 connection as soon as it raises up to a given level of CPU usage or if it exceeds a certain connection time. Is this right?

Dan

[CHRIS_ANORUO]

Hi Paula,

If you combine these (ps -ef|grep " vdx"|awk '{print $2,$5,$7,$8}'|pg), the process the has the highest CPU time can be killed.
You can then use kill -9 PID(in question).

[Sandor Horvath_2]

Hi !

You can write an awk script,

see substrt() and system() functions in awk

export UNIX95=
while true
do
ps -C vdx -o "pid cpu stime" | awk -f scrpit.awk
sleep 5
done

but,
nobody sure the pid still contain same process when use ps and when You kill it....

regards, Saa

[Paula J Frazer-Campbell]

Hi Dan
What happens is that competition will get a valid login and passwd and use that to screen scape - so on that login and passwd I can have a valid user as well.
Once I identify that screen scaping is going on I will call the valid user and change their password, but in the travel industry staff move from company to company so this is an ongoing battle.

Paula

[Paula J Frazer-Campbell]

Hi to all,
More info :-

What I wish to to is make this routine automatic once I decide what time parameters to set.
So what I am trying to do is:-


ps -ef|(ETC)
if CPU is greater than xxx, get PID then kill it OR
if Connect time is greater than xxx, get PID then kill it
sleep xx
do it again

Thanks for help so far
Paula

[Dan Hetzel · Accepted solution]

Hi Paula,

Here is already something to play with...

#!/usr/bin/sh
ps -ef | grep " vdx" | grep -v grep | awk '{print $2, $5, $7}' | while read pid time cpu
do
# comment out the echo after you've played with the script
echo pid is $pid, time is $time, cpu is $cpu

# To get rid of the ??:?? format, simply strip the ':'
# set formatted cpu into cpu00
cpu00=`echo $cpu | sed 's/://'`

# test for cpu greater than 20 seconds
if [ $cpu00 -gt 20 ]
then
echo kill -9 $pid
fi
done

Some test could be done on the connection time after having substituted the ':' by nothing, just like I did with cpu.

I know it's quick and dirty, but it's a starting point... ;-)

Best regards,

Dan

[Paula J Frazer-Campbell]

Thanks once again to all

;^) Paula

[Dan Hetzel]

Hi Paula,

2 more cents:

If you want to check for connect time, you should compare values of:
time00=`echo $time | sed '/://'`
and
currenttime=`date "+%H%M%S"`

As both are 6 digits numbers, the difference will be easy to compute and can be used in a test.

Have fun,

Dan

[James R. Ferguson]

Hi Paula:

My approach would be the same as Dan's.

My suggestion to you would be to "kill kindly". You can collect the PIDs you want to kill as a space-delimited list in a variable and do:

# kill $PIDS > /dev/null 2>&1 #...graceful
# sleep 5
# kill -9 $PIDS > /dev/null 2>&1 #...for those who won't die...

...BTW, I've written this in good old US-English... ;-)

Regards! Jim.

...JRF...

[Paula J Frazer-Campbell]

Thanks James

Your info has helped and the US-English comment certainly brighened up a busy Friday.

This reply is being written is just plain old English as there is only one real version.

Have a nice day y,all.

;-) Paula

[Paula J Frazer-Campbell]

Hi and thanks to all for your help, I am placing here the finished script so that the wheel does not need to be reinvented.

Paula
----------------cut here--------------
###########################################################
# VDX CONNECTION MONITORING /CONTROL #
###########################################################
#!/usr/bin/sh
# Get info on the users
# Change the ? vdx? to suit particular user
# If using logging ensure it has space to grow ?last line
ps -ef | grep " vdx" | grep -v grep | awk '{print $2, $5, $7}' | while read pid
time cpu
do
# Strip the ':'
cpu00=`echo $cpu | sed 's/://'`
time00=`echo $time | sed 's/://'`
time000=`echo $time00 | sed 's/://'`
currenttime=`date "+%H%M%S"`
#
# Calculate total time connected
timeon=`print $currenttime - $time000|bc`
#
# CPU usage
if [ $cpu00 -gt 30 ]
then
echo EXCESSIVE CPU USER ON : $pid
# When it happened
echo $currenttime
kill $pid # Gracefull kill
sleep 5
kill -9 $pid
fi
#
# Time connected
if [ $timeon -gt 1800 ]
then
echo EXCESSIVE TIME CONNECTED ON :$pid
# When it happened
echo $currenttime
kill $pid # Gracefull kill
sleep 5
kill -9 $pid # Go away kill
fi
done
# Sleep for 30 seconds and do it again -sending info to logfile
sleep 30
exec /sysadmin/menus/vdxwatch >> vdxlog 2>&1
----------------cut here--------------

[Dan Hetzel]

Hi Paula,

What you could do, instead of the 'exec' at the end of your script, is adding another control loop surrounding all your code, like this:

#!/usr/bin/sh
exec > /tmp/vdxlog 2>&1
while true
do
# all your code comes here
sleep 30
done

This would keep the same process id as long as your program is running, so that you would be able to watch its cpu usage.

You could use a redirect like '>/tmp/vdklog$$' to make the log unique for each instance of your program, $$ standing for the PID.

Best regards,

Dan