#!/bin/bash

# This is a script to identify user processes that have been running

# longer than a pre set number of days.

　

# **** BEGIN CONFIGURABLE PARAMETERS ****

# WARNING!! The following values should NOT be NULL.

# The script will not work with NULL values.

# Path to the logfile

LOG=/var/log/prockill

# List of groups to which users belong to

# The format should be ‘group1| group2| group3| group4′

GROUP=’everyone| utmp| 2000′

# Set the maximum age of a process before it is killed or email notification is sent

# If you want to notify users after 5 days and kill processes after 8 days then

# AGEKILL=’1-| 2-| 3-| 4-| 5-| 6-| 7-| 8-’

# AGEMAIL=’1-| 2-| 3-| 4-| 5-’

# AGE=3

AGEKILL=’1-| 2-| 3-| 4-| 5-| 6-| 7-| 8-| 9-| 10-| 11-| 12-| 13-| 14-| 15-| 16-| 17-| 18-| 19-| 20-| 21-| 22-| 23-| 24-’

AGEEMAIL=’1-| 2-| 3-| 4-| 5-| 6-| 7-| 8-| 9-| 10-| 11-| 12-| 13-| 14-| 15-| 16-| 17-| 18-| 19-| 20-’

AGE=3

# Email Address to send notifications to

MAIL=user@email.com

# Exceptions: processes that you dont want to kill

EXCP=’ldap’

# **** END CONFIGURABLE PARAMETERS ****

　

# **** USER NOTIFICATION & PROCESS KILL ****

# Check if users have been notified

if [ -f /tmp/prockill.notified ]

then

# **** PROCESS KILL ****

if [ "`find /tmp/prockill.notified -mtime +$AGE`" != "" ] # Checking if the file was created x days ago

then # If file was created x days ago, its been x days since the users were notified.

# Demarc start of log

echo “**** Start List Processes Killed on `date` ****” >> $LOG

# Logging list of processes that match our conditions

ps -A -o user,pid,etime,group,args | egrep “$GROUP” | egrep -v “$EXCP” | grep “-” | egrep -v “$AGEKILL” >> $LOG

# Demarc start of log

echo “**** End List Processes Killed on `date` ****” >> $LOG

# Issuing SIGTERM to give processes a chance to exit gracefully

kill -15 `ps -A -o user,pid,etime,group,args | egrep “$GROUP” | egrep -v “$EXCP” | grep “-” | egrep -v “$AGEKILL” | cut -c10-15` > /dev/null

# Wait for 30 seconds to allow processes to terminate

echo “Waiting for processess to cleanly exit…”

sleep 30s

# Issuing SIGKILL to force all misbehaving processes to die.

kill -9 `ps -A -o user,pid,etime,group,args | egrep “$GROUP” | egrep -v “$EXCP” | grep “-” | egrep -v “$AGEKILL” | cut -c10-15` > /dev/null

rm -rf /tmp/prockill.notified # Clear the notified flag

exit 1

fi

else

# **** USER NOTIFICATION ****

# Get list of users and number of processes owned by them.

ps -A -o user,pid,etime,group | egrep “$GROUP” | egrep -v “$EXCP” | grep “-” | egrep -v “$AGEEMAIL” | cut -d’ ‘ -f1 | uniq -c >> /tmp/prockill.eml

# Send email only if the filesize is greater than 0

if [ -s /tmp/prockill.eml ]

then

# Log notification.

echo “**** Start List Notified Processes on `date` ****” >> $LOG

echo “The following users have the indicated number of proceses that will be killed in 24 hours:”

cat /tmp/prockill.eml >> $LOG

echo “**** End List Notified Processes on `date` ****” >> $LOG

# Email Process list

mail -s “$HOSTNAME – Old Process Report” $MAIL < /tmp/prockill.eml

rm -rf /tmp/prockill.eml

touch /tmp/prockill.notified # Set notified flag

exit 1

else

# Log notification

echo “**** Start List Notified Processes on `date` ****” >> $LOG

echo “No old processes to kill!” >> $LOG

echo “**** End List Notified Processes on `date` ****” >> $LOG

exit 1

fi

fi

Related posts:

1. Active Directory Password Expiry Reminder Email
2. Active Directory Audit Script