兼容收集user/crontab/listen几处特殊异常情况

agent/collect/crontab_linux.go

@@ -8,7 +8,7 @@ import (
 )
 
 // GetCrontab 获取计划任务
-func GetCrontab() (resultData []map[string]string) {
+/*func GetCrontab() (resultData []map[string]string) {
 	//系统计划任务
 	dat, err := ioutil.ReadFile("/etc/crontab")
 	if err != nil {
@@ -50,4 +50,74 @@ func GetCrontab() (resultData []map[string]string) {
 		}
 	}
 	return resultData
+}*/
+
+//修复crontab中空格不规则导致异常
+func GetCrontab() (resultData []map[string]string) {
+	//系统计划任务
+	dat, err := ioutil.ReadFile("/etc/crontab")
+	if err != nil {
+		d <- resultData
+		return resultData
+	}
+	cronList := strings.Split(string(dat), "\n")
+	for _, info := range cronList {
+		if strings.HasPrefix(info, "#") || strings.Count(info, " ") < 6 {
+			continue
+		}
+		//s := strings.SplitN(info, " ", 7)
+		_, cmd := GetCmd(info, 7)
+		tmp := strings.Split(info, " "+cmd)[0]
+		_, user := GetCmd(tmp, 6)
+		rule := strings.Split(tmp, " "+user)[0]
+		m := map[string]string{"command": cmd, "user": user, "rule": rule}
+		resultData = append(resultData, m)
+	}
+
+	//用户计划任务
+	dir, err := ioutil.ReadDir("/var/spool/cron/")
+	if err != nil {
+		return resultData
+	}
+	for _, f := range dir {
+		if f.IsDir() {
+			continue
+		}
+		dat, err = ioutil.ReadFile("/var/spool/cron/" + f.Name())
+		if err != nil {
+			continue
+		}
+		cronList = strings.Split(string(dat), "\n")
+		for _, info := range cronList {
+			if strings.HasPrefix(info, "#") || strings.Count(info, " ") < 5 {
+				continue
+			}
+			_, cmd := GetCmd(info, 6)
+			rule := strings.Split(info, " "+cmd)[0]
+			m := map[string]string{"command": cmd, "user": f.Name(), "rule": rule}
+			resultData = append(resultData, m)
+		}
+	}
+	return resultData
+}
+
+func GetCmd(r string, c int) (rule string, cmd string) {
+
+	n := 0
+	mark := 0
+	t1 := strings.Split(r, " ")
+	for k, v := range t1 {
+		v = strings.TrimSpace(v)
+		if len(v) == 0 {
+			continue
+		} else {
+			mark++
+			if mark == c {
+				n = k + 1
+				break
+			}
+		}
+	}
+	t2 := strings.SplitN(r, " ", n)
+	return t2[0], t2[n-1]
 }

agent/collect/listen_linux.go

@@ -22,24 +22,25 @@ func GetListening() (resultData []map[string]string) {
 		m := make(map[string]string)
 		reg := regexp.MustCompile("\\s+")
 		info = reg.ReplaceAllString(strings.TrimSpace(info), " ")
-		s := strings.Split(info, " ")
+		//s := strings.Split(info, " ")
+		s := strings.SplitN(info, " ", 6) //修复ss -lnpt 进程名字为空导致panic
 		if len(s) < 6 {
 			continue
 		}
 		m["proto"] = "TCP"
-		if strings.Contains(s[3],"::"){
+		if strings.Contains(s[3], "::") {
 			m["address"] = strings.Replace(s[3], "::", "0.0.0.0", 1)
-		}else{
+		} else {
 			m["address"] = strings.Replace(s[3], "*", "0.0.0.0", 1)
 		}
 		b := false
-		for _,v:= range resultData{
-			if v["address"] == m["address"]{
+		for _, v := range resultData {
+			if v["address"] == m["address"] {
 				b = true
 				break
 			}
 		}
-		if b{
+		if b {
 			continue
 		}
 		reg = regexp.MustCompile(`users:\(\("(.*?)",(.*?),.*?\)`)

agent/collect/user_linux.go

@@ -8,7 +8,7 @@ import (
 )
 
 // GetUser 获取系统用户列表
-func GetUser() (resultData []map[string]string) {
+/*func GetUser() (resultData []map[string]string) {
 	dat, err := ioutil.ReadFile("/etc/passwd")
 	if err != nil {
 		return resultData
@@ -26,4 +26,30 @@ func GetUser() (resultData []map[string]string) {
 		resultData = append(resultData, m)
 	}
 	return resultData
+}*/
+
+// GetUser 获取系统用户列表,修复最后一行到的nologin用户被过滤
+func GetUser() (resultData []map[string]string) {
+	//defer RunDefer(d, resultData)
+	dat, err := ioutil.ReadFile("/etc/passwd")
+	if err != nil {
+		return resultData
+	}
+	userList := strings.Split(string(dat), "\n")
+	if len(userList) < 2 {
+		d <- resultData
+		return
+	}
+	for _, info := range userList {
+		if len(info) < 6 {
+			continue
+		}
+		if strings.Contains(info, "/nologin") {
+			continue
+		}
+		s := strings.SplitN(info, ":", 2)
+		m := map[string]string{"name": s[0], "description": s[1]}
+		resultData = append(resultData, m)
+	}
+	return resultData
 }