#!/bin/bash

hostguard_log=/var/log/hostguard/hostguard.log
hostwatch_log=/var/log/hostguard/hostwatch.log
log_file=/var/log/hostguard/csa_snapshot.log
snapshot_dir=/usr/local/hostguard/data/snapshot
snapshot_file=/usr/local/hostguard/data/snapshot.tar.gz

function init_log_file()
{
    if [ -f $log_file ];then
        log_size=`ls -l $log_file | awk '{ print $5 }'`
        if [ $log_size -gt 102400 ];then
            if [ -f $log_file.1 ];then
                rm -f $log_file.1 >/dev/null 2>&1
            fi
            mv $log_file $log_file.1 >/dev/null 2>&1
        fi
    fi
}

function write_log()
{
    cur_time=$(date "+%Y-%m-%d %H:%M:%S")
    echo "$cur_time: "$1 >> $log_file 2>&1
}

init_log_file
write_log "======== collect log begin ========"

write_log "clean temp files ..."
rm -rf /usr/local/hostguard/data/snapshot >> $log_file 2>&1
rm -f $snapshot_file >> $log_file 2>&1

mkdir -p $snapshot_dir >> $log_file 2>&1

write_log "copy system key config file ..."

uname -a > $snapshot_dir/uname.txt 2>&1
cat /etc/ld.so.preload > $snapshot_dir/preload.txt 2>&1
cat /etc/selinux/config | grep SELINUX > $snapshot_dir/selinux.txt 2>&1
cat /proc/meminfo > $snapshot_dir/meminfo.txt 2>&1
cat /proc/sys/fs/inotify/max_user_instances > $snapshot_dir/inotify_max_user_instances.txt 2>&1
cat /proc/sys/fs/inotify/max_user_watches > $snapshot_dir/inotify_max_user_watches.txt 2>&1

cat /etc/issue > $snapshot_dir/os_issue.txt 2>&1
cat /etc/os-release > $snapshot_dir/os_release.txt 2>&1
cat /etc/euleros-release > $snapshot_dir/euleros-release.txt 2>&1
cat /etc/redhat-release > $snapshot_dir/redhat-release.txt 2>&1
cat /etc/SuSE-release > $snapshot_dir/suse-release.txt 2>&1
cat /etc/euleros-release > $snapshot_dir/euleros-release.txt 2>&1
cat /etc/fedora-release > $snapshot_dir/fedora-release.txt 2>&1
cat /etc/gentoo-release > $snapshot_dir/gentoo-release.txt 2>&1

write_log "check current system running status ..."

top -b -n 1 > $snapshot_dir/system_top.txt 2>&1
env > $snapshot_dir/env.log 2>&1
lsmod > $snapshot_dir/lsmod.txt 2>&1
ip addr > $snapshot_dir/ipaddr.txt 2>&1
cat /proc/self/cgroup > $snapshot_dir/system_cgroup.txt 2>&1
cat /proc/self/maps > $snapshot_dir/system_maps.txt 2>&1

ps -ef | wc -l > $snapshot_dir/ps_wc.txt 2>&1
ps axjf > $snapshot_dir/ps.txt 2>&1

netstat -nao | wc -l > $snapshot_dir/netstat_wc.txt 2>&1
netstat -nao | grep LISTEN | wc -l > $snapshot_dir/netstat_listen_wc.txt 2>&1
netstat -alntu > $snapshot_dir/netstat.txt 2>&1

hostguard_pid=$(cat /usr/local/hostguard/run/hostguard.pid)
if [ $hostguard_pid -gt 1 ] 2>/dev/null; then
    cat /proc/$hostguard_pid/cgroup > $snapshot_dir/hostguard_cgroup.txt 2>&1
    cat /proc/$hostguard_pid/status > $snapshot_dir/hostguard_status.txt 2>&1
fi

hostwatch_pid=$(cat /usr/local/hostguard/run/hostwatch.pid)
if [ $hostwatch_pid -gt 1 ] 2>/dev/null; then
    cat /proc/$hostwatch_pid/cgroup > $snapshot_dir/hostwatch_cgroup.txt 2>&1
    cat /proc/$hostwatch_pid/status > $snapshot_dir/hostwatch_status.txt 2>&1
fi

write_log "copy policy files ..."
mkdir $snapshot_dir/policy >> $log_file 2>&1
cp -f /usr/local/hostguard/policy/*.policy $snapshot_dir/policy/ >> $log_file 2>&1

write_log "copy config files ..."
mkdir $snapshot_dir/conf >> $log_file 2>&1
cp -f /usr/local/hostguard/conf/*.conf $snapshot_dir/conf/ >> $log_file 2>&1

write_log "copy run files ..."
mkdir $snapshot_dir/run >> $log_file 2>&1
cp -f /usr/local/hostguard/run/*.conf $snapshot_dir/run/ >> $log_file 2>&1
cp -f /usr/local/hostguard/run/*.dat $snapshot_dir/run/ >> $log_file 2>&1

write_log "======== collect log end ========"
write_log "start to compress log file to snapshot.tar.gz"

tar -czvf $snapshot_file --ignore-failed-read /usr/local/hostguard/log /var/log/hostguard $snapshot_dir >/dev/null 2>&1

if [ -f $snapshot_file ]; then
    log_file_size=`ls -l $snapshot_file | awk '{ print $5 }'`
    if [ $log_file_size -gt 52428800 ]; then
        write_log "$snapshot_file is too large, remove it."
        rm -f $snapshot_file
        tar -czvf $snapshot_file --ignore-failed-read $hostguard_log $hostwatch_log $log_file >/dev/null 2>&1
        log_file_size=`ls -l $snapshot_file | awk '{ print $5 }'`
        if [ $log_file_size -gt 52428800 ]; then
            write_log "sample $snapshot_file is too large too, remove it."
            rm -f $snapshot_file
        fi
    fi
fi


rm -rf /usr/local/hostguard/data/snapshot >> $log_file 2>&1

write_log "compress log file success, and remove temp log files."
