204 lines
23 KiB
JavaScript
204 lines
23 KiB
JavaScript
|
/**
|
|||
|
|
* 巡检报告 — 每 catalog 的命令组定义
|
|||
|
|
*
|
|||
|
|
* 与告警巡检（每 5min）不同：
|
|||
|
|
* - 频率低（每 1h 一次）
|
|||
|
|
* - 命令多（15-20 条/台）
|
|||
|
|
* - 输出大（display logbuffer 可能几千字）
|
|||
|
|
* - 存独立文件 inspection-report.json（不碰 inspection-data.json）
|
|||
|
|
*
|
|||
|
|
* 每个条目: { cmd: string, purpose: string }
|
|||
|
|
* preCmd: 每种 catalog 前置命令（关闭分页等），只跑一次
|
|||
|
|
*/
|
|||
|
|
|
|||
|
|
const REORT_COMMANDS_BY_CATALOG = {
|
|||
|
|
|
|||
|
|
// ─── Linux 服务器（云主机 / 物理机通用）──────
|
|||
|
|
// 分层设计：硬件 → OS → 资源 → 网络 → 安全 → 服务 → 日志 → 虚拟化
|
|||
|
|
// 原则：只读、幂等、有兜底、输出可控
|
|||
|
|
linux_server: {
|
|||
|
|
shell: "bash",
|
|||
|
|
preCmd: null,
|
|||
|
|
commands: [
|
|||
|
|
// ═══ 1. 基础身份识别 ═══
|
|||
|
|
{ cmd: "echo '=== OS ==='; cat /etc/os-release 2>/dev/null | head -5; echo '=== KERNEL ==='; uname -a; echo '=== HOST ==='; hostname 2>/dev/null; echo '=== UPTIME ==='; uptime", purpose: "OS 发行版 + 内核 + 主机名 + 运行时长" },
|
|||
|
|
{ cmd: "echo '=== CPU ==='; lscpu 2>/dev/null | egrep 'Model name|CPU\\(s\\)|Thread|Core|Socket|MHz|Flags.*vmx|Flags.*svm' || cat /proc/cpuinfo | egrep 'model name|processor|cpu MHz' | head -15", purpose: "CPU 型号 / 核心数 / 虚拟化能力" },
|
|||
|
|
{ cmd: "echo '=== MEMINFO ==='; cat /proc/meminfo | grep -E 'MemTotal|MemAvailable|MemFree|Buffers|Cached|SwapTotal|SwapFree|Dirty|Writeback'; echo '=== FREE_H ==='; free -h 2>/dev/null; echo '=== DIMM ==='; dmidecode -t memory 2>/dev/null | egrep 'Size|Type|Speed|Manufacturer' | head -20 || echo 'dmidecode_not_available'", purpose: "内存原始数据（/proc/meminfo 精确字段 + free -h + DIMM）" },
|
|||
|
|
{ cmd: "echo '=== DISK ==='; lsblk -o NAME,SIZE,TYPE,ROTA,TEMPERATURE,MODEL 2>/dev/null || fdisk -l 2>/dev/null | head -30 || echo 'lsblk/fdisk_not_available'", purpose: "磁盘块设备 + SSD/HDD 区分 + 温度" },
|
|||
|
|
{ cmd: "df -hT -x tmpfs -x devtmpfs -x overlay 2>/dev/null | head -20", purpose: "文件系统使用率（排除临时系统）" },
|
|||
|
|
{ cmd: "df -i -x tmpfs -x devtmpfs 2>/dev/null | head -15", purpose: "inode 使用率" },
|
|||
|
|
{ cmd: "echo '=== SMART ==='; for d in $(ls /dev/sd* /dev/nvme* /dev/vd* 2>/dev/null | grep -v '[0-9]'); do echo \"-- $d --\"; smartctl -H $d 2>/dev/null || echo 'no_smartctl'; done | head -30", purpose: "磁盘健康（SMART）" },
|
|||
|
|
|
|||
|
|
// ═══ 2. 资源实时状态 ═══
|
|||
|
|
{ cmd: "echo '=== LOAD ==='; uptime; echo '=== CPU_TOP ==='; top -bn1 | head -12; echo '=== MEM_TOP ==='; ps aux --sort=-%mem | head -10", purpose: "负载 + CPU/内存 Top 进程快照" },
|
|||
|
|
{ cmd: "vmstat 1 3 2>/dev/null || vmstat 2 2>/dev/null | head -5", purpose: "CPU/内存/IO 实时活动" },
|
|||
|
|
{ cmd: "echo '=== IO ==='; iostat -x 1 2 2>/dev/null | tail -40 || iostat 2>/dev/null | head -20 || echo 'iostat_not_available'", purpose: "磁盘 IO 统计 + await 时间" },
|
|||
|
|
{ cmd: "echo '=== NET_STAT ==='; nstat -az 2>/dev/null | tail -20 || ss -s 2>/dev/null; echo '=== TCP_SOCK ==='; ss -tan state established 2>/dev/null | wc -l; echo '=== UDP_SOCK ==='; ss -uan 2>/dev/null | wc -l", purpose: "网络收发统计 + TCP/UDP 会话数" },
|
|||
|
|
|
|||
|
|
// ═══ 3. 硬件健康（传感器） ═══
|
|||
|
|
{ cmd: "echo '=== TEMP ==='; sensors 2>/dev/null | head -40 || (cat /sys/class/thermal/thermal_zone*/temp 2>/dev/null | while read t; do echo \"temp: $((t/1000))C\"; done) || echo 'no_sensors_data'", purpose: "CPU/主板温度" },
|
|||
|
|
{ cmd: "echo '=== DISK_TEMP ==='; hddtemp /dev/sd? 2>/dev/null || for d in /sys/class/scsi_disk/*/device; do bn=$(basename $(dirname $d)); temp=$(cat $d/../../block/$bn/queue/rotational 2>/dev/null | grep -q 1 && cat $d/../../../../../../devices/platform/*/ata*/host*/target*/*/scsi_disk/*/temperature 2>/dev/null); [ -n \"$temp\" ] && echo \"$bn: ${temp}C\"; done || echo 'disk_temp_not_available'", purpose: "磁盘温度（hddtemp 或 sysfs 兜底）" },
|
|||
|
|
{ cmd: "echo '=== RAID ==='; cat /proc/mdstat 2>/dev/null || echo 'no_mdraid'; echo '=== LVM ==='; pvs 2>/dev/null | head -10 || echo 'no_lvm'; echo '=== BTRFS ==='; btrfs filesystem show 2>/dev/null | head -10 || echo 'no_btrfs'", purpose: "阵列/卷管理状态" },
|
|||
|
|
{ cmd: "echo '=== UPS ==='; upsc 2>/dev/null | head -10 || echo 'ups_not_monitored'; echo '=== BATTERY ==='; cat /sys/class/power_supply/BAT*/status 2>/dev/null | head -5 || echo 'no_laptop_battery'", purpose: "电源/UPS/笔记本电池" },
|
|||
|
|
|
|||
|
|
// ═══ 4. 网络配置 ═══
|
|||
|
|
{ cmd: "echo '=== IP ==='; ip -br addr 2>/dev/null; echo '=== LINK ==='; ip -br link 2>/dev/null; echo '=== RX_ERROR ==='; ip -s link 2>/dev/null | egrep '(errors|dropped):|RX:|TX:' | head -30", purpose: "接口 IP + up/down + 网卡错误包统计" },
|
|||
|
|
{ cmd: "echo '=== ROUTE ==='; ip route 2>/dev/null; echo '=== GATEWAY_PING ==='; ping -c 2 -W 2 $(ip route show default 2>/dev/null | awk '{print $3; exit}') 2>/dev/null | tail -5 || echo 'no_default_gateway'", purpose: "路由表 + 默认网关连通性" },
|
|||
|
|
{ cmd: "echo '=== DNS ==='; cat /etc/resolv.conf 2>/dev/null | head -10; echo '=== DNS_TEST ==='; timeout 3 nslookup www.baidu.com 2>/dev/null | tail -5 || timeout 3 host www.baidu.com 2>/dev/null | tail -5 || echo 'no_dns_tool'", purpose: "DNS 配置 + 解析测试" },
|
|||
|
|
{ cmd: "echo '=== CONNTRACK ==='; conntrack -C 2>/dev/null || echo 'no_conntrack'; echo '=== SYNFLOOD ==='; sysctl net.ipv4.tcp_max_syn_backlog 2>/dev/null; echo '=== TIME_WAIT ==='; ss -tan state time-wait 2>/dev/null | wc -l; echo '=== ESTAB ==='; ss -tan state established 2>/dev/null | wc -l", purpose: "连接跟踪 + SYN backlog + 连接状态分布" },
|
|||
|
|
|
|||
|
|
// ═══ 5. 安全检查 ═══
|
|||
|
|
{ cmd: "echo '=== OPEN_PORTS ==='; ss -tulnp 2>/dev/null | head -30; echo '=== LISTEN_UNKNOWN_USER ==='; ss -tulnp 2>/dev/null | grep -v 'Users:' | head -10 || echo 'all_listen_have_owner'", purpose: "监听端口 + 异常无名端口" },
|
|||
|
|
{ cmd: "echo '=== LAST_LOGIN ==='; last -n 5 2>/dev/null | head -8; echo '=== FAILED_LOGIN ==='; lastb -n 10 2>/dev/null | head -12 || echo 'no_failed_logins_or_lastb'; echo '=== CURRENT ==='; who 2>/dev/null", purpose: "登录历史 + 失败登录 + 当前在线" },
|
|||
|
|
{ cmd: "echo '=== SUSPICIOUS_PROC ==='; ps aux 2>/dev/null | egrep 'miner|xmrig|cryptonight|stratum|nc .* -l|/dev/tcp|reverse shell|bash -i.*>&' | grep -v grep | head -10 || echo 'no_suspicious_process'; echo '=== ROOT_PROC ==='; ps aux 2>/dev/null | awk '$1==\"root\" && $11 !~ /^(\\[|/usr/sbin|/usr/bin|/bin|/sbin|systemd|ps\\b)/ && NR>1 {print $11}' | sort -u | head -20", purpose: "挖矿/反弹 shell 可疑进程 + root 运行的非标准路径进程" },
|
|||
|
|
{ cmd: "echo '=== SUID_FILES ==='; find / -perm -4000 -type f 2>/dev/null | xargs -r ls -la 2>/dev/null | awk '{print $NF, $1}' | head -20; echo '=== WORLD_WRITABLE ==='; find /etc -perm -o+w -type f 2>/dev/null | head -10 || echo 'no_world_writable_etc'", purpose: "SUID 文件（检查提权后门）+ /etc 下可写文件" },
|
|||
|
|
{ cmd: "echo '=== FIREWALL ==='; (iptables -L -n 2>/dev/null | head -30) || (ufw status 2>/dev/null) || (firewall-cmd --list-all 2>/dev/null) || echo 'no_firewall_active'; echo '=== SELINUX ==='; getenforce 2>/dev/null || echo 'selinux_not_available'; echo '=== APPARMOR ==='; aa-status 2>/dev/null | head -5 || echo 'apparmor_not_available'", purpose: "防火墙 + MAC 强制访问控制状态" },
|
|||
|
|
|
|||
|
|
// ═══ 6. 服务状态 ═══
|
|||
|
|
{ cmd: "echo '=== FAILED_SVC ==='; systemctl --failed --no-pager 2>/dev/null | head -15 || echo 'systemd_not_available'; echo '=== SVC_TOTAL ==='; systemctl list-units --type=service --no-pager 2>/dev/null | wc -l; echo '=== CRON ==='; crontab -l 2>/dev/null | head -15 || echo 'no_user_cron'; echo '=== AT ==='; atq 2>/dev/null | head -5 || echo 'no_at_jobs'", purpose: "失败 systemd 服务 + 定时任务" },
|
|||
|
|
{ cmd: "echo '=== KEY_SVC ==='; for svc in sshd ssh nginx httpd apache2 mysql mysqld postgres redis-server docker containerd kubelet; do systemctl is-active $svc 2>/dev/null | grep -q active && echo \"$svc: active\"; done; echo '=== DOCKER ==='; docker ps --format 'table {{.Names}}\\t{{.Status}}\\t{{.Ports}}' 2>/dev/null | head -15 || echo 'no_docker'", purpose: "关键服务状态 + Docker 容器" },
|
|||
|
|
|
|||
|
|
// ═══ 7. 系统日志（分层获取，AI 重点分析） ═══
|
|||
|
|
{ cmd: "echo '=== JOURNAL_ERR ==='; journalctl -p err..alert -n 80 --no-pager -q 2>/dev/null | tail -40 || (grep -i 'error\\|fail\\|critical\\|panic' /var/log/syslog /var/log/messages 2>/dev/null | tail -30) || echo 'no_error_log'", purpose: "最近 error/critical 级别（journal + syslog 兜底）" },
|
|||
|
|
{ cmd: "echo '=== JOURNAL_WARN ==='; journalctl -p warning..warning -n 80 --no-pager -q 2>/dev/null | tail -40 || (grep -i 'warning\\|warn\\|alert' /var/log/syslog /var/log/messages 2>/dev/null | tail -25) || echo 'no_warn_log'", purpose: "最近 warning 级别日志" },
|
|||
|
|
{ cmd: "echo '=== JOURNAL_30MIN ==='; journalctl --since '30 min ago' -n 100 --no-pager -q 2>/dev/null | tail -50 || echo 'no_recent_30min_log'", purpose: "最近 30 分钟全部日志（时间窗口过滤）" },
|
|||
|
|
{ cmd: "echo '=== KERNEL_LOG ==='; journalctl -k -n 60 --no-pager -q 2>/dev/null | tail -30 || (dmesg 2>/dev/null | tail -25) || echo 'no_kernel_log'; echo '=== OOM ==='; (dmesg 2>/dev/null | grep -i 'oom\\|out of memory\\|killed process' || journalctl -k 2>/dev/null | grep -i oom) | tail -10 || echo 'no_oom_event'; echo '=== KERNEL_PANIC ==='; (dmesg 2>/dev/null | grep -i 'panic\\|oops\\|general protection' || journalctl -k 2>/dev/null | grep -i 'panic\\|oops') | tail -10 || echo 'no_panic_oops'", purpose: "内核日志 + OOM + panic/oops（三类关键内核事件分开过滤）" },
|
|||
|
|
{ cmd: "echo '=== AUDIT_LOG ==='; (ausearch -ie -ts recent -30m 2>/dev/null | head -40) || (grep -i 'denied\\|avc:\\|audit.*denied\\|user=root' /var/log/audit/audit.log 2>/dev/null | tail -25) || echo 'no_audit_log'; echo '=== FAILED_AUTH ==='; (grep -i 'failed password\\|authentication failure\\|invalid user' /var/log/auth.log /var/log/secure 2>/dev/null | tail -20) || journalctl _COMM=sshd --since '30 min ago' 2>/dev/null | grep -i fail | tail -15 || echo 'no_failed_auth'", purpose: "审计日志 + SSH 失败登录" },
|
|||
|
|
{ cmd: "echo '=== AUTH_LAST ==='; lastb -n 15 2>/dev/null | head -18 || echo 'no_lastb'; echo '=== SUDO ==='; tail -20 /var/log/auth.log 2>/dev/null | grep -i sudo || tail -20 /var/log/secure 2>/dev/null | grep -i sudo || journalctl _COMM=sudo --since '1 hour ago' 2>/dev/null | tail -15 || echo 'no_sudo_log'", purpose: "lastb 失败登录 + sudo 执行记录" },
|
|||
|
|
|
|||
|
|
// ═══ 8. 虚拟化 / 云环境检测 ═══
|
|||
|
|
{ cmd: "echo '=== VIRT ==='; hostnamectl 2>/dev/null | grep -i virtual || systemd-detect-virt 2>/dev/null || echo 'no_virt_detect'; echo '=== CLOUD ==='; (curl -s --connect-timeout 1 http://169.254.169.254/latest/meta-data/instance-id 2>/dev/null | head -1 && echo 'aws_detected') || echo 'not_aws'; (curl -s --connect-timeout 1 -H 'Metadata: true' http://169.254.168.254/metadata/instance?api-version=2021-02-01 2>/dev/null | grep -q 'compute' && echo 'azure_detected') || echo 'not_azure'; echo '=== SNAP ==='; snap list 2>/dev/null | head -5 || echo 'no_snap'; echo '=== FLAT ==='; flatpak list 2>/dev/null | head -5 || echo 'no_flatpak'", purpose: "虚拟化类型 + 云厂商 + 包管理器" },
|
|||
|
|
|
|||
|
|
// ═══ 9. 资源异常阈值（快速告警） ═══
|
|||
|
|
{ cmd: "echo '=== THRESHOLD ==='; echo 'CPU_LOAD_15:' $(awk '{print $1}' /proc/loadavg)/$(nproc 2>/dev/null || echo 1); echo 'MEM_USED_PCT:' $(awk '/MemTotal/{t=$2}/MemAvailable/{a=$2}END{printf \"%.1f\",(t-a)/t*100}' /proc/meminfo 2>/dev/null); echo 'SWAP_USED_PCT:' $(awk '/SwapTotal/{t=$2}/SwapFree/{f=$2}END{if(t>0) printf \"%.1f\",(t-f)/t*100; else print \"0.0\"}' /proc/meminfo 2>/dev/null); echo 'ROOT_USED_PCT:' $(df / 2>/dev/null | awk 'NR==2{print $5}' | tr -d %); echo 'INODE_ROOT_PCT:' $(df -i / 2>/dev/null | awk 'NR==2{print $5}' | tr -d %); echo 'PROC_COUNT:' $(ps aux --no-headers 2>/dev/null | wc -l); echo 'FD_PERCENT:' $(awk '{if($3>0) printf \"%.1f\",$1/$3*100; else print \"0.0\"}' /proc/sys/fs/file-nr 2>/dev/null)", purpose: "资源阈值快速快照（AI 异常识别主数据源，/proc/meminfo 精确计算）" },
|
|||
|
|
|
|||
|
|
// ═══ 10. 时间同步 ═══
|
|||
|
|
{ cmd: "echo '=== NTP_CHRONY ==='; chronyc tracking 2>/dev/null | head -10 || echo 'no_chronyc'; chronyc sources 2>/dev/null | head -10 || true; ntpq -p 2>/dev/null | head -10 || echo 'no_ntpq'; echo '=== DATE ==='; date -u; echo '=== HWCLK ==='; timedatectl 2>/dev/null | head -8 || echo 'no_timedatectl'", purpose: "NTP/Chrony 时间同步状态 + 硬件时钟" },
|
|||
|
|
|
|||
|
|
// ═══ 11. 最近变更（变更历史） ═══
|
|||
|
|
{ cmd: "echo '=== APT_DPKG ==='; test -f /var/log/apt/history.log && zgrep -E 'Start-Date|End-Date|Commandline|Install|Upgrade|Remove' /var/log/apt/history.log* 2>/dev/null | tail -25 || echo 'no_apt_log'; echo '=== DNF_YUM ==='; dnf history 2>/dev/null | head -12 || yum history 2>/dev/null | head -12 || echo 'no_dnf_yum'; echo '=== RECENT_PKG ==='; ls -lt /var/cache/apt/archives/ 2>/dev/null | head -8 || ls -lt /var/cache/yum/ 2>/dev/null | head -8 || echo 'no_pkg_cache'", purpose: "最近包安装/升级历史" },
|
|||
|
|
|
|||
|
|
// ═══ 12. Swap + 限制检查 ═══
|
|||
|
|
{ cmd: "echo '=== SWAP ==='; swapon --show 2>/dev/null || cat /proc/swaps 2>/dev/null; echo '=== SWAPPINESS ==='; cat /proc/sys/vm/swappiness 2>/dev/null; echo '=== ULIMIT ==='; ulimit -a 2>/dev/null | head -8; echo '=== FD_LIMIT ==='; cat /proc/sys/fs/file-max 2>/dev/null; echo '=== CURRENT_FD ==='; cat /proc/sys/fs/file-nr 2>/dev/null; echo '=== CORE_PATTERN ==='; cat /proc/sys/kernel/core_pattern 2>/dev/null", purpose: "Swap 策略 + fd/进程限制 + core dump 配置" },
|
|||
|
|
|
|||
|
|
// ═══ 13. 内核模块 + PCI ═══
|
|||
|
|
{ cmd: "echo '=== LSMOD ==='; lsmod 2>/dev/null | head -30 || cat /proc/modules 2>/dev/null | head -20 || echo 'no_module'; echo '=== PCI_ERR ==='; dmesg 2>/dev/null | grep -i 'pcie\\|mce\\|machine check\\|pci error' | tail -10 || echo 'no_pci_error'; echo '=== SYSCTL_CORE ==='; sysctl -a 2>/dev/null | egrep 'kernel\\.(panic|oops|modprobe|kptr)' | head -10 || echo 'no_sysctl'", purpose: "内核模块 + PCI 硬件错误 + 内核 panic/oops 策略" },
|
|||
|
|
|
|||
|
|
// ═══ 14. K8s / 容器编排探测 ═══
|
|||
|
|
{ cmd: "echo '=== KUBELET ==='; systemctl is-active kubelet 2>/dev/null || echo 'no_kubelet'; echo '=== KUBE_NODES ==='; kubectl get nodes --no-headers 2>/dev/null || echo 'no_kubectl_or_no_cluster'; echo '=== KUBE_PODS ==='; kubectl get pods -A --no-headers --field-selector=status.phase!=Running 2>/dev/null | head -15 || echo 'no_non_running_pod_or_no_kubectl'; echo '=== CRI ==='; crictl ps 2>/dev/null | head -10 || echo 'no_crictl'", purpose: "K8s 节点状态 + 非 Running Pod 列表 + CRI 容器" },
|
|||
|
|
],
|
|||
|
|
},
|
|||
|
|
|
|||
|
|
// ─── Huawei/H3C 交换机 ─────────────────────
|
|||
|
|
huawei_h3c_switch: {
|
|||
|
|
shell: "huawei_cli",
|
|||
|
|
preCmd: "screen-length 0 temporary",
|
|||
|
|
commands: [
|
|||
|
|
{ cmd: "display version", altCmd: null, purpose: "型号 + 固件 + 启动时长" },
|
|||
|
|
{ cmd: "display device", altCmd: "display device all", purpose: "所有板卡模块状态 (Master/Slave/Registered)" },
|
|||
|
|
{ cmd: "display temperature", altCmd: "display temperature all", purpose: "各板卡温度" },
|
|||
|
|
{ cmd: "display fan", altCmd: "display fan all", purpose: "风扇状态" },
|
|||
|
|
{ cmd: "display power", altCmd: "display power all", purpose: "电源状态" },
|
|||
|
|
{ cmd: "display memory", altCmd: "display memory-usage", purpose: "内存使用率" },
|
|||
|
|
{ cmd: "display cpu", altCmd: "display cpu-usage 5 1", purpose: "CPU 使用率快照" },
|
|||
|
|
{ cmd: "display interface brief", altCmd: "display ip interface brief", purpose: "所有端口 up/down + 收发包统计" },
|
|||
|
|
{ cmd: "display ip interface brief", altCmd: "display interface brief", purpose: "三层 Vlanif 接口 IP 状态" },
|
|||
|
|
{ cmd: "display arp", altCmd: "display arp all", purpose: "ARP 表" },
|
|||
|
|
{ cmd: "display logbuffer level warning size 200", altCmd: "display logbuffer size 200", purpose: "最近 warning 级别日志" },
|
|||
|
|
{ cmd: "display stp", altCmd: "display stp brief", purpose: "STP 角色 + 阻塞端口" },
|
|||
|
|
{ cmd: "display vrrp", altCmd: null, purpose: "VRRP 状态" },
|
|||
|
|
{ cmd: "display ntp status", altCmd: "display ntp-service status", purpose: "NTP peer + stratum" },
|
|||
|
|
{ cmd: "display vlan", altCmd: "display vlan brief", purpose: "VLAN 列表 + 端口归属" },
|
|||
|
|
],
|
|||
|
|
},
|
|||
|
|
|
|||
|
|
// ─── Cisco IOS 交换机 ─────────────────────
|
|||
|
|
cisco_switch: {
|
|||
|
|
shell: "cisco_ios",
|
|||
|
|
preCmd: "terminal length 0",
|
|||
|
|
commands: [
|
|||
|
|
{ cmd: "show version", purpose: "型号 + IOS 版本 + 启动时长" },
|
|||
|
|
{ cmd: "show inventory", purpose: "硬件模块 + 序列号" },
|
|||
|
|
{ cmd: "show environment status", purpose: "电源 + 风扇 + 温度" },
|
|||
|
|
{ cmd: "show processes cpu sorted 1min", purpose: "CPU Top 进程（1min 平均）" },
|
|||
|
|
{ cmd: "show memory summary", purpose: "内存总量/已用" },
|
|||
|
|
{ cmd: "show interfaces brief", purpose: "所有端口 up/down" },
|
|||
|
|
{ cmd: "show interfaces counters errors", purpose: "端口错误包（CRC/input error）" },
|
|||
|
|
{ cmd: "show ip interface brief", purpose: "三层接口 IP 状态" },
|
|||
|
|
{ cmd: "show arp", purpose: "ARP 表" },
|
|||
|
|
{ cmd: "show log tail 100", purpose: "最近 100 行日志" },
|
|||
|
|
{ cmd: "show spanning-tree summary", purpose: "STP 总览" },
|
|||
|
|
{ cmd: "show vlan brief", purpose: "VLAN 列表" },
|
|||
|
|
{ cmd: "show ip route summary", purpose: "路由表总览" },
|
|||
|
|
{ cmd: "show ntp status", purpose: "NTP peer + stratum" },
|
|||
|
|
],
|
|||
|
|
},
|
|||
|
|
|
|||
|
|
// ─── Huawei 防火墙 ─────────────────────────
|
|||
|
|
huawei_firewall: {
|
|||
|
|
shell: "huawei_cli",
|
|||
|
|
preCmd: "screen-length 0 temporary",
|
|||
|
|
commands: [
|
|||
|
|
{ cmd: "display version", purpose: "型号 + 固件" },
|
|||
|
|
{ cmd: "display device", purpose: "模块状态" },
|
|||
|
|
{ cmd: "display temperature", purpose: "温度" },
|
|||
|
|
{ cmd: "display fan", purpose: "风扇" },
|
|||
|
|
{ cmd: "display power", purpose: "电源" },
|
|||
|
|
{ cmd: "display memory", purpose: "内存" },
|
|||
|
|
{ cmd: "display firewall session table | include Total", purpose: "会话表统计" },
|
|||
|
|
{ cmd: "display security-policy rule all | head -20", purpose: "安全策略概览" },
|
|||
|
|
{ cmd: "display logbuffer level warning size 200", purpose: "最近 warning 日志" },
|
|||
|
|
{ cmd: "display ntp status", purpose: "NTP" },
|
|||
|
|
],
|
|||
|
|
},
|
|||
|
|
|
|||
|
|
// ─── Fortinet FortiOS 防火墙 ────────────────
|
|||
|
|
fortinet_firewall: {
|
|||
|
|
shell: "fortigate",
|
|||
|
|
preCmd: "set console length 0",
|
|||
|
|
commands: [
|
|||
|
|
{ cmd: "get system status", purpose: "型号 + FortiOS 版本 + 启动时长" },
|
|||
|
|
{ cmd: "get system performance cpu", purpose: "CPU 使用率" },
|
|||
|
|
{ cmd: "get system performance memory", purpose: "内存使用率" },
|
|||
|
|
{ cmd: "get system hardware", purpose: "硬件模块 + 温度 + 风扇" },
|
|||
|
|
{ cmd: "get session stat", purpose: "会话统计" },
|
|||
|
|
{ cmd: "get router info routing-table summary", purpose: "路由表" },
|
|||
|
|
{ cmd: "diag debug flow stat", purpose: "流量统计" },
|
|||
|
|
{ cmd: "get log report local-traffic", purpose: "最近流量日志" },
|
|||
|
|
{ cmd: "execute time", purpose: "系统时间 + NTP" },
|
|||
|
|
],
|
|||
|
|
},
|
|||
|
|
|
|||
|
|
// ─── 默认 fallback（catalog 未知）────────────
|
|||
|
|
// 自适应识别：先探测是什么类型的设备，再按类型跑对应的精简命令
|
|||
|
|
unknown: {
|
|||
|
|
shell: "unknown",
|
|||
|
|
preCmd: null,
|
|||
|
|
commands: [
|
|||
|
|
// 探测 1：能不能跑 bash？→ Linux
|
|||
|
|
{ cmd: "echo '=== DETECT ==='; uname -a 2>&1 | head -3; echo '=== TRY_LINUX ==='; ls /proc/version 2>/dev/null && echo IS_LINUX || echo NOT_LINUX; which bash 2>/dev/null; echo '=== TRY_SWITCH ==='; echo '=== OS_PROMPT_CHECK ==='; cat /etc/os-release 2>/dev/null | head -3 || true", purpose: "探测设备类型（Linux / 交换机 / 防火墙）" },
|
|||
|
|
|
|||
|
|
// 如果探测到 Linux，这些命令在 Linux 上有效；交换机上会报 command not found（被 ERROR_PATTERNS 过滤掉也没关系）
|
|||
|
|
{ cmd: "echo '=== BASIC ==='; hostname 2>/dev/null || host; uptime 2>/dev/null || echo 'no_uptime'; free -h 2>/dev/null || echo 'no_free'; df -h 2>/dev/null | head -10 || echo 'no_df'; whoami", purpose: "基础系统信息（Linux 优先）" },
|
|||
|
|
{ cmd: "echo '=== CPU ==='; cat /proc/cpuinfo 2>/dev/null | head -15 || echo 'no_cpuinfo'; echo '=== MEM ==='; cat /proc/meminfo 2>/dev/null | head -5 || echo 'no_meminfo'", purpose: "CPU/内存（Linux /proc 方式）" },
|
|||
|
|
{ cmd: "echo '=== NET ==='; ip addr 2>/dev/null | head -20 || ifconfig 2>/dev/null | head -20 || echo 'no_net_cmd'; ip route 2>/dev/null | head -5 || echo 'no_route'; ss -tulnp 2>/dev/null | head -15 || netstat -tulnp 2>/dev/null | head -15 || echo 'no_socket_cmd'", purpose: "网络接口 + 监听端口" },
|
|||
|
|
{ cmd: "echo '=== TOP ==='; top -bn1 2>/dev/null | head -15 || ps aux 2>/dev/null | head -15 || echo 'no_top'; echo '=== DISK ==='; lsblk 2>/dev/null || fdisk -l 2>/dev/null | head -20 || echo 'no_disk'; echo '=== TEMP ==='; sensors 2>/dev/null | head -15 || cat /sys/class/thermal/thermal_zone*/temp 2>/dev/null || echo 'no_temp'", purpose: "Top 进程 + 磁盘 + 温度" },
|
|||
|
|
{ cmd: "echo '=== FAILED_SVC ==='; systemctl --failed --no-pager 2>/dev/null | head -10 || echo 'no_systemd'; echo '=== ERR_LOG ==='; journalctl -p err..alert -n 20 --no-pager 2>/dev/null | tail -15 || (grep -i 'error\\|fail\\|critical' /var/log/syslog /var/log/messages 2>/dev/null | tail -10) || echo 'no_log'; echo '=== OOM ==='; dmesg 2>/dev/null | grep -i oom | tail -5 || echo 'no_oom'", purpose: "失败服务 + 错误日志" },
|
|||
|
|
{ cmd: "echo '=== SEC ==='; ps aux 2>/dev/null | egrep 'miner|xmrig|nc .* -l|bash -i.*>&' | grep -v grep | head -5 || echo 'no_suspicious'; last -n 5 2>/dev/null || echo 'no_last'; echo '=== THRESHOLD ==='; echo 'LOAD:' $(awk '{print $1}' /proc/loadavg 2>/dev/null || echo 0); echo 'MEM_PCT:' $(free 2>/dev/null | awk '/Mem:/{printf \"%.1f\",$3/$2*100}' || echo 0); echo 'DISK_ROOT:' $(df / 2>/dev/null | awk 'NR==2{print $5}' || echo 0)", purpose: "安全快速检查 + 资源阈值" },
|
|||
|
|
|
|||
|
|
// 如果探测到交换机/防火墙，这些 show/display 命令有效
|
|||
|
|
{ cmd: "echo '=== SHOW_VERSION ==='; show version 2>&1 | head -20 || echo 'show_version_failed'; echo '=== DISPLAY_VERSION ==='; display version 2>&1 | head -20 || echo 'display_version_failed'; echo '=== SHOW_ENV ==='; show environment 2>&1 | head -20 || display environment 2>&1 | head -20 || echo 'env_failed'", purpose: "版本/硬件状态（交换机/防火墙）" },
|
|||
|
|
{ cmd: "echo '=== SHOW_INT ==='; show interfaces brief 2>&1 | head -25 || display interface brief 2>&1 | head -25 || echo 'int_failed'; echo '=== SHOW_INV ==='; show inventory 2>&1 | head -20 || display device 2>&1 | head -20 || echo 'inv_failed'", purpose: "端口 + 板卡（交换机/防火墙）" },
|
|||
|
|
],
|
|||
|
|
},
|
|||
|
|
};
|
|||
|
|
|
|||
|
|
function getReportCommands(catalogId) {
|
|||
|
|
return REORT_COMMANDS_BY_CATALOG[catalogId] || REORT_COMMANDS_BY_CATALOG.unknown;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
module.exports = {
|
|||
|
|
REORT_COMMANDS_BY_CATALOG,
|
|||
|
|
getReportCommands,
|
|||
|
|
};
|