一个日志分析的脚本，查找可疑的IP并拒绝掉【转贴】

#!/bin/sh
### FileName: ddos_drop.sh
### Auth: Sunshine GU

###程序文件路径
nginx_log_file=/home/wwwlogs/access.log
apache_log_file=/var/log/httpd/access.log

###IP列表存储路径
grep_list=drop_ip.dat
###IP列表排除
else_list='192.168.14|127.0.0.1|0.0.0.0'

###监控端口
grep_port='80|8080|443'

###执行间隔时间(s)
exec_time=60

###清空旧的非法IP
if [ -e $grep_list ];then
rm -f $grep_list
fi

###服务器为nginx，则启动此过程
nginx_moudle() {
tail $nginx_log_file -n 1000|grep -E 'GET|POST'|awk {'print $1'}|sort|uniq -c|sort -nr|awk '{if ($2!="-" && $1>100) {print $2}}' > $grep_list
for i in `cat $grep_list`
do
if [ $i!=`iptables --list|grep $i|awk {'print $4'}` ];
then
/sbin/iptables -I INPUT -s $i -j DROP;
fi
done
}

###服务器为apache，则启动此过程
apache_moudle() {
tail $apache_log_file -n 1000|grep -E 'GET|POST'|awk {'print $1'}|sort|uniq -c|sort -nr|awk '{if ($2!="-" && $1>100) {print $2}}' > $grep_list
for i in `cat $grep_list`
do
if [ $i!=`iptables --list|grep $i|awk {'print $4'}` ];
then
/sbin/iptables -I INPUT -s $i -j DROP;
fi
done
}

###根据连接状态进行IP屏蔽
netstat_moudle() {
/bin/netstat -ant |grep -E $grep_port|awk '{print $5}'|awk -F : '{print $1}'|sort|uniq -c|sort -rn|grep -v -E $else_list|awk '{if ($2!=null && $1>50) {print $2}}' > $grep_list
for i in `cat $grep_list`
do
if [ $i!=`iptables --list|grep $i|awk {'print $4'}` ];
then
/sbin/iptables -I INPUT -s $i -j DROP;
fi
done
}

###启动命令控制
case "$1" in
nginx)
while true
do
nginx_moudle
sleep $exec_time
done
;;
apache)
while true
do
apache_moudle
sleep $exec_time
done
;;
netstat)
while true
do
netstat_moudle
sleep $exec_time
done
;;
*)
echo $"Usage: $prog {nginx|apache|netstat}"
exit 1
esac