post-analyse.sh

#!/bin/bash -e

# Name:    modules/post-analyse.sh
# Summary: Custom script that analyses the content of the history error log file generated by the main script wwwsas.sh from the same packages.
#          The script is designed to be executed via CRON Job as well as SHELL Command.
# Home:    https://github.com/metalevel-tech/wwwsas
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, version 3.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; See the GNU General Public License for more details.
#
# Usage. The sctipt has two modes.
# - Default mode, that will outut the result in CLI: '/path/to/post-analyse.sh' or 'wwwsas-post-analyse'
# - AutoMode, that should be used in Root`s Crontab: '* * * * * "/path/to/post-analyse.sh" 'AutoMode' >> "/path/to/tmp/execution.log" 2>&1'


# -------------------------
# Read the user's input
# -------------------------

# The script should be run as root
[[ "$EUID" -ne 0 ]] && { echo "Please run as root (use sudo)."; exit 0; }


# -------------------------
# Environment setup section
# -------------------------

# The directory where the script is located - see the 'default' note in the beginning.
WORK_DIR="/etc/wwwsas"
CONF_FILE="${WORK_DIR}/wwwsas.conf"

# Load/source the configuration file
if [[ -f $CONF_FILE ]]
then
    source "${CONF_FILE}"
else
    echo "Please use \"${CONF_FILE}.example\" and create your own \"${CONF_FILE}\""
    exit 0
fi


# ---------------------------------
# The main script section
# ---------------------------------

if [[ -s "${WWW_SAS_ERROR_LOG_HISTORY}" ]]
then

    while read -r IP_SINS IP
    do

        ## Output a log header
        printf '\n\n*****\nSECURITY LOG from %s on %s : %s >>' "$TIME" "$DATE" "$WWW_SAS_FLOOD_DETECTOR_EXEC" >> "$WWW_SAS_EXEC_LOG" 2>&1

        # Call WWW Security Assistant Script
        eval "${WWW_SAS_EXEC}" "$IP" "${AGENT_PSTANL}" "$IP_SINS" && sleep 1

    done < <(awk -v limit="$POST_ANALYSE_LIMIT" '{c[$8]++} END{for(i in c) { if ( c[i] >= limit ) print c[i] " ", i } }' "$WWW_SAS_ERROR_LOG_HISTORY")

    cat <(printf '\n%s %s\n\n' "$DATE" "$TIME") "${WWW_SAS_ERROR_LOG_HISTORY}" >> "${WWW_SAS_ERROR_LOG_HISTORY}.processed"
    >"${WWW_SAS_ERROR_LOG_HISTORY}"

fi