вот мой вариант скрипта
#!/usr/bin/perl
use POSIX;
$tcpdump='/usr/sbin/tcpdump';
$runfile='/var/run/viruscatch';
$logfile='/tmp/tcpdump';
$clientfile='/home/httpd/html/billing/virusclients';
sub onexit {
unlink $runfile;
exit 0;
}
sub onexit2 {
if($childpid>0) {
kill 15,$childpid;
}
}
$SIG{INT} = \&onexit;
$SIG{TERM} = \&onexit;
$SIG{CHILD} = \&onexit;
if( -e $runfile) {
if(!open(FILE,"<$runfile")) {
print "Cant't open existing pidfile $runfile! Aborting...\n";
exit 1;
}
$oldpid=<FILE>;
close FILE;
$cnt=kill 0,$oldpid;
print "$oldpid=$cnt \n";
if($cnt==0) {
print "Remove stale lock $runfile\n";
unlink $runfile;
}
else {
print "Another process already running! Aborting...\n";
exit 1;
}
}
if(!open(FILE,">$runfile")) {
print "Can't open pidfile for write. Aborting...\n";
exit 1;
}
print FILE $$;
close FILE;
$childpid=fork();
if(!defined($childpid)) {
print "Can't fork!\n";
onexit();
}
if($childpid!=0) {
#parent process
$SIG{INT}=\&onexit2;
$SIG{KILL}=\&onexit2;
$SIG{ALRM}=\&onexit2;
alarm 15;
wait();
}
else {
#child process
open STDIN, '/dev/null' or die "Can't read /dev/null: $!";
open STDOUT,">$logfile" or die "Can't write to $logfile: $!";
open STDERR,'>/dev/null' or die "Can't write to /dev/null: $!";
@args=("-c","2048","-i","eth0","-n","-q","dst","port","445");
exec $tcpdump, @args;
}
$currtime=time();
if(open(FILE,"<$logfile")) {
while(<FILE>) {
@a=split /\s+/;
$a[1]=~/^(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})/;
$ips{$1}+=1;
}
close FILE;
if(open(FILE,"<$clientfile")) {
while(<FILE>) {
chomp;
@a=split /\s+/;
# print $a[0]," ",$a[1],"\n";
if($a[1]+86400 > $currtime && $a[0] ne '') {
$clients{$a[0]}=$a[1];
}
}
close FILE;
}
for $key (keys %ips) {
if($ips{$key}>5) { $clients{$key}=$currtime; }
}
if(open(FILE,">$clientfile")) {
for $key (keys %clients) {
print FILE $key," ",$clients{$key},"\n";
}
close FILE;
}
}
onexit();
Вариант для распечатки
Программирование под UNIX (Public)
(??) on
03-Июн-05, 11:18 (MSK)
