Skip to content

Commit d777bfc

Browse files
wesleyschollwesleyscholl
authored
feat(scripts): add 10 new scripts covering network, security, DB, and system diagnostics
- feat: dns-lookup-check.sh — DNS resolution checker with expected IP validation - feat: network-latency-report.sh — ping-based latency monitor with threshold alerting - feat: swap-usage-monitor.sh — swap usage percentage monitor - feat: mysql-slow-query-report.sh — MySQL slow query log parser and ranker - feat: disk-throughput-test.sh — dd-based sequential read/write benchmark - feat: kernel-parameter-audit.sh — sysctl security baseline auditor (10 params) - feat: certificate-renewal-check.sh — TLS cert expiry checker for files and live hosts - feat: large-file-finder.sh — largest files finder with human-readable output - feat: uptime-reporter.sh — uptime, load average, and reboot history reporter - feat: log-error-summary.sh — error pattern counter and ranker for log triage - test: corresponding bats test file for each script (100 new tests, 568 total) - docs: update README with 10 new scripts in correct categories (69+ total) - docs: update CHANGELOG [Unreleased] section
1 parent 18e799f commit d777bfc

22 files changed

Lines changed: 1557 additions & 4 deletions

‎CHANGELOG.md‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
77

88
## [Unreleased]
99

10+
### Added
11+
- `scripts/dns-lookup-check.sh` — verify DNS resolution for hostnames with optional expected-IP validation
12+
- `scripts/network-latency-report.sh` — ping-based latency monitor with configurable count and threshold
13+
- `scripts/swap-usage-monitor.sh` — alert when swap usage percentage exceeds a threshold
14+
- `scripts/mysql-slow-query-report.sh` — parse MySQL slow query log and rank top offenders by query time
15+
- `scripts/disk-throughput-test.sh` — dd-based sequential read/write benchmark for a target directory
16+
- `scripts/kernel-parameter-audit.sh` — audit sysctl parameters against a hardened security baseline
17+
- `scripts/certificate-renewal-check.sh` — check TLS certificates (files or live hosts) for expiry status
18+
- `scripts/large-file-finder.sh` — find the largest files in a directory tree with human-readable output
19+
- `scripts/uptime-reporter.sh` — report system uptime, boot time, load averages, and recent reboots
20+
- `scripts/log-error-summary.sh` — count and rank error patterns in log files for rapid incident triage
21+
- Corresponding BATS test files for all 10 scripts above (100 new tests, 568 total)
22+
23+
## [1.3.0] - 2026-06-28
24+
1025
### Added
1126
- CI pipeline (`.github/workflows/ci.yml`) — ShellCheck lint + BATS test suite on every push and PR
1227
- `CONTRIBUTING.md` — contributor guide with script style guide, test requirements, and PR workflow

‎README.md‎

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ A comprehensive collection of production-ready Bash scripts for DevOps engineers
88
[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
99
[![Shell](https://img.shields.io/badge/Shell-Bash-green.svg)](https://www.gnu.org/software/bash/)
1010
[![Test Coverage](https://img.shields.io/badge/Test%20Coverage-100%25-brightgreen.svg)](tests/)
11-
[![Tests](https://img.shields.io/badge/Tests-468%20total-success.svg)](tests/)
11+
[![Tests](https://img.shields.io/badge/Tests-568%20total-success.svg)](tests/)
1212

1313
<img width="600" alt="bash" src="https://github.com/user-attachments/assets/2bd21a84-eac3-4309-9404-3b21bf31ac26" />
1414

@@ -65,6 +65,9 @@ To address these gaps, the recent expansion adds 25 new scripts and 25 matching
6565
| `service-status-check.sh` | Checks systemd service active/enabled status |
6666
| `env-var-audit.sh` | Audits required environment variables and flags missing values |
6767
| `process-zombie-report.sh` | Reports zombie processes for host hygiene checks |
68+
| `swap-usage-monitor.sh` | Monitors swap usage and alerts when it exceeds a threshold |
69+
| `uptime-reporter.sh` | Reports system uptime, boot time, and recent reboot history |
70+
| `log-error-summary.sh` | Counts and ranks error patterns in a log file for rapid triage |
6871

6972
### DevOps & CI/CD
7073

@@ -94,6 +97,8 @@ To address these gaps, the recent expansion adds 25 new scripts and 25 matching
9497
| `api-latency-monitor.sh` | Measures endpoint latency and alerts on threshold breaches |
9598
| `tcp-connectivity-check.sh` | Validates TCP connectivity to host and port targets |
9699
| `cpu-load-watch.sh` | Alerts when 1-minute load average exceeds threshold |
100+
| `dns-lookup-check.sh` | Verifies DNS resolution for hostnames and detects failures or IP mismatches |
101+
| `network-latency-report.sh` | Pings hosts and reports round-trip latency with threshold alerting |
97102

98103
### Backup & Recovery
99104

@@ -131,6 +136,8 @@ To address these gaps, the recent expansion adds 25 new scripts and 25 matching
131136
| `cron-job-audit.sh` | Audits cron definitions for risky patterns and permission issues |
132137
| `ssh-config-audit.sh` | Audits SSH daemon hardening settings in sshd_config |
133138
| `file-permission-audit.sh` | Finds world-writable files under a target directory |
139+
| `kernel-parameter-audit.sh` | Checks critical sysctl parameters against a secure baseline |
140+
| `certificate-renewal-check.sh` | Checks TLS certificates for expiry and outputs actionable renewal status |
134141

135142
### Git & Developer Productivity
136143

@@ -144,6 +151,9 @@ To address these gaps, the recent expansion adds 25 new scripts and 25 matching
144151
|--------|-------------|
145152
| `random-password-generator.sh` | Generates secure random passwords |
146153
| `url-encode.sh` | URL-encodes strings for safe query and API usage |
154+
| `large-file-finder.sh` | Finds the largest files in a directory tree, sorted by size |
155+
| `disk-throughput-test.sh` | Benchmarks sequential read and write throughput on a directory |
156+
| `mysql-slow-query-report.sh` | Parses MySQL slow query logs and reports the top offenders by query time |
147157

148158
## 🔧 Prerequisites
149159

@@ -297,7 +307,7 @@ bats -t tests/*.bats
297307

298308
### Test Coverage
299309

300-
- **468 total tests** covering all shell scripts
310+
- **568 total tests** covering all shell scripts
301311
- **25 new tests** added for security, reliability, and developer-workflow scripts
302312
- **Platform-aware skips** remain for tool-specific/system-specific test cases
303313
- **Comprehensive coverage** of:
@@ -366,14 +376,14 @@ This project is licensed under the MIT License - see the [LICENSE](LICENSE) file
366376
## � Project Status
367377

368378
**Current State:** Production-grade DevOps automation toolkit with enterprise deployment capabilities
369-
**Script Collection:** 59+ battle-tested automation scripts covering system administration, CI/CD, security, reliability, and monitoring
379+
**Script Collection:** 69+ battle-tested automation scripts covering system administration, CI/CD, security, reliability, and monitoring
370380
**Achievement:** Comprehensive infrastructure automation suite used in production environments
371381

372382
This collection represents years of DevOps engineering experience distilled into reusable, production-ready automation scripts. Each script is designed with enterprise reliability, security best practices, and comprehensive error handling.
373383

374384
### Technical Achievements
375385

376-
- ✅ **Production-Ready Scripts:** 59+ scripts battle-tested in real production environments across multiple organizations
386+
- ✅ **Production-Ready Scripts:** 69+ scripts battle-tested in real production environments across multiple organizations
377387
- ✅ **Comprehensive Coverage:** Full automation suite spanning system administration, CI/CD, monitoring, and container management
378388
- ✅ **Enterprise Security:** Built-in security best practices with credential management and audit logging
379389
- ✅ **Cross-Platform Compatibility:** POSIX-compliant scripts tested on Linux, macOS, and cloud environments

‎scripts/certificate-renewal-check.sh‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
#!/bin/bash
2+
# certificate-renewal-check.sh — Check whether TLS certificates need renewal and output actionable status
3+
# Usage: ./scripts/certificate-renewal-check.sh [OPTIONS] <cert-file-or-host> [...]
4+
5+
set -euo pipefail
6+
7+
WARN_DAYS=30
8+
CRIT_DAYS=7
9+
ALERT_COUNT=0
10+
11+
show_usage() {
12+
cat << EOF
13+
Usage: $(basename "$0") [OPTIONS] <cert-file-or-host[:port]> [...]
14+
15+
Checks certificate expiry for local PEM files or live HTTPS/SMTPS/IMAPS hosts.
16+
Exits non-zero if any certificate is within the critical or warning window.
17+
18+
Options:
19+
-w, --warn-days <days> Warn threshold in days (default: $WARN_DAYS)
20+
-c, --crit-days <days> Critical threshold in days (default: $CRIT_DAYS)
21+
-h, --help Show this help message
22+
23+
Arguments:
24+
cert-file-or-host Path to a PEM certificate file, or host[:port] for a live check
25+
26+
Examples:
27+
$(basename "$0") /etc/ssl/certs/my.crt
28+
$(basename "$0") --warn-days 60 --crit-days 14 example.com:443 api.example.com
29+
EOF
30+
exit 0
31+
}
32+
33+
if [[ $# -eq 0 ]]; then
34+
echo "Error: at least one certificate file or host is required."
35+
show_usage
36+
fi
37+
38+
TARGETS=()
39+
while [[ $# -gt 0 ]]; do
40+
case "$1" in
41+
-h|--help) show_usage ;;
42+
-w|--warn-days)
43+
WARN_DAYS="$2"
44+
if ! [[ "$WARN_DAYS" =~ ^[0-9]+$ ]]; then echo "Error: warn-days must be an integer"; exit 1; fi
45+
shift 2 ;;
46+
-c|--crit-days)
47+
CRIT_DAYS="$2"
48+
if ! [[ "$CRIT_DAYS" =~ ^[0-9]+$ ]]; then echo "Error: crit-days must be an integer"; exit 1; fi
49+
shift 2 ;;
50+
-*) echo "Error: unknown option '$1'"; show_usage ;;
51+
*) TARGETS+=("$1"); shift ;;
52+
esac
53+
done
54+
55+
if [[ ${#TARGETS[@]} -eq 0 ]]; then
56+
echo "Error: at least one certificate file or host is required."
57+
show_usage
58+
fi
59+
60+
if ! command -v openssl >/dev/null 2>&1; then
61+
echo "Error: openssl command is required"
62+
exit 1
63+
fi
64+
65+
check_cert() {
66+
local target="$1"
67+
local enddate
68+
69+
if [[ -f "$target" ]]; then
70+
enddate=$(openssl x509 -in "$target" -noout -enddate 2>/dev/null | cut -d= -f2)
71+
else
72+
local host port
73+
host="${target%%:*}"
74+
port="${target##*:}"
75+
[[ "$port" == "$host" ]] && port=443
76+
enddate=$(echo | openssl s_client -servername "$host" -connect "${host}:${port}" 2>/dev/null \
77+
| openssl x509 -noout -enddate 2>/dev/null | cut -d= -f2)
78+
fi
79+
80+
if [[ -z "$enddate" ]]; then
81+
echo "ERROR: $target — could not retrieve certificate"
82+
(( ALERT_COUNT++ ))
83+
return
84+
fi
85+
86+
local expiry_epoch now_epoch days_left
87+
expiry_epoch=$(date -d "$enddate" +%s 2>/dev/null || date -jf "%b %d %T %Y %Z" "$enddate" +%s 2>/dev/null)
88+
now_epoch=$(date +%s)
89+
days_left=$(( (expiry_epoch - now_epoch) / 86400 ))
90+
91+
if (( days_left < 0 )); then
92+
echo "EXPIRED: $target — expired $(( -days_left )) day(s) ago ($enddate)"
93+
(( ALERT_COUNT++ ))
94+
elif (( days_left <= CRIT_DAYS )); then
95+
echo "CRITICAL: $target — expires in ${days_left} day(s) ($enddate)"
96+
(( ALERT_COUNT++ ))
97+
elif (( days_left <= WARN_DAYS )); then
98+
echo "WARNING: $target — expires in ${days_left} day(s) ($enddate)"
99+
(( ALERT_COUNT++ ))
100+
else
101+
echo "OK: $target — expires in ${days_left} day(s) ($enddate)"
102+
fi
103+
}
104+
105+
echo "Certificate renewal check — $(date '+%Y-%m-%d %H:%M:%S')"
106+
echo " Warning: < ${WARN_DAYS} days"
107+
echo " Critical: < ${CRIT_DAYS} days"
108+
echo "-----------------------------------------------------------"
109+
110+
for target in "${TARGETS[@]}"; do
111+
check_cert "$target"
112+
done
113+
114+
echo "-----------------------------------------------------------"
115+
if [[ "$ALERT_COUNT" -gt 0 ]]; then
116+
echo "Result: $ALERT_COUNT certificate(s) require attention"
117+
exit 1
118+
fi
119+
echo "Result: all certificates are within acceptable validity"
120+
exit 0

‎scripts/disk-throughput-test.sh‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
#!/bin/bash
2+
# disk-throughput-test.sh — Benchmark sequential read and write throughput on a directory
3+
# Usage: ./scripts/disk-throughput-test.sh [OPTIONS] [directory]
4+
5+
set -euo pipefail
6+
7+
TEST_DIR="${TMPDIR:-/tmp}"
8+
FILE_SIZE_MB=100
9+
BLOCK_SIZE="1M"
10+
11+
show_usage() {
12+
cat << EOF
13+
Usage: $(basename "$0") [OPTIONS] [directory]
14+
15+
Writes a test file and reads it back to measure disk throughput.
16+
17+
Options:
18+
-s, --size <mb> Test file size in MB (default: $FILE_SIZE_MB)
19+
-h, --help Show this help message
20+
21+
Arguments:
22+
directory Target directory for the benchmark (default: $TEST_DIR)
23+
24+
Examples:
25+
$(basename "$0")
26+
$(basename "$0") --size 256 /mnt/data
27+
EOF
28+
exit 0
29+
}
30+
31+
while [[ $# -gt 0 ]]; do
32+
case "$1" in
33+
-h|--help) show_usage ;;
34+
-s|--size)
35+
FILE_SIZE_MB="$2"
36+
if ! [[ "$FILE_SIZE_MB" =~ ^[1-9][0-9]*$ ]]; then
37+
echo "Error: size must be a positive integer"
38+
exit 1
39+
fi
40+
shift 2 ;;
41+
-*) echo "Error: unknown option '$1'"; show_usage ;;
42+
*) TEST_DIR="$1"; shift ;;
43+
esac
44+
done
45+
46+
if [[ ! -d "$TEST_DIR" ]]; then
47+
echo "Error: directory not found: $TEST_DIR"
48+
exit 1
49+
fi
50+
51+
if ! command -v dd >/dev/null 2>&1; then
52+
echo "Error: dd command is required"
53+
exit 1
54+
fi
55+
56+
TEST_FILE="${TEST_DIR}/disk_throughput_test_$$.tmp"
57+
58+
cleanup() { rm -f "$TEST_FILE"; }
59+
trap cleanup EXIT
60+
61+
echo "Disk throughput test — $(date '+%Y-%m-%d %H:%M:%S')"
62+
echo " Directory: $TEST_DIR"
63+
echo " File size: ${FILE_SIZE_MB} MB"
64+
echo " Block size: $BLOCK_SIZE"
65+
echo "-----------------------------------------------"
66+
67+
# Write test
68+
echo "Write test..."
69+
write_result=$(dd if=/dev/urandom of="$TEST_FILE" bs="$BLOCK_SIZE" count="$FILE_SIZE_MB" 2>&1)
70+
write_speed=$(echo "$write_result" | awk '/copied/{for(i=1;i<=NF;i++) if($i~/MB\/s|GB\/s/) {print $(i-1),$i}}' | tail -1)
71+
echo " Write speed: ${write_speed:-N/A}"
72+
73+
# Flush page cache if possible (requires root on Linux), otherwise skip
74+
sync
75+
if [[ -w /proc/sys/vm/drop_caches ]]; then
76+
echo 1 > /proc/sys/vm/drop_caches 2>/dev/null || true
77+
fi
78+
79+
# Read test
80+
echo "Read test..."
81+
read_result=$(dd if="$TEST_FILE" of=/dev/null bs="$BLOCK_SIZE" 2>&1)
82+
read_speed=$(echo "$read_result" | awk '/copied/{for(i=1;i<=NF;i++) if($i~/MB\/s|GB\/s/) {print $(i-1),$i}}' | tail -1)
83+
echo " Read speed: ${read_speed:-N/A}"
84+
85+
echo "-----------------------------------------------"
86+
echo "Benchmark complete."
87+
exit 0

‎scripts/dns-lookup-check.sh‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
#!/bin/bash
2+
# dns-lookup-check.sh — Verify DNS resolution for a list of hostnames and detect failures or unexpected IPs
3+
# Usage: ./scripts/dns-lookup-check.sh [OPTIONS] <hostname> [hostname...]
4+
5+
set -euo pipefail
6+
7+
EXPECTED_IP=""
8+
TIMEOUT=5
9+
ALERT_COUNT=0
10+
11+
show_usage() {
12+
cat << EOF
13+
Usage: $(basename "$0") [OPTIONS] <hostname> [hostname...]
14+
15+
Resolves each hostname via DNS and reports failures or mismatches.
16+
17+
Options:
18+
-e, --expected <ip> Alert if resolved IP does not match this value
19+
-h, --help Show this help message
20+
21+
Arguments:
22+
hostname One or more hostnames to resolve
23+
24+
Examples:
25+
$(basename "$0") example.com api.example.com
26+
$(basename "$0") --expected 93.184.216.34 example.com
27+
EOF
28+
exit 0
29+
}
30+
31+
if [[ $# -eq 0 ]]; then
32+
echo "Error: at least one hostname is required."
33+
show_usage
34+
fi
35+
36+
HOSTNAMES=()
37+
while [[ $# -gt 0 ]]; do
38+
case "$1" in
39+
-h|--help) show_usage ;;
40+
-e|--expected) EXPECTED_IP="$2"; shift 2 ;;
41+
-*) echo "Error: unknown option '$1'"; show_usage ;;
42+
*) HOSTNAMES+=("$1"); shift ;;
43+
esac
44+
done
45+
46+
if [[ ${#HOSTNAMES[@]} -eq 0 ]]; then
47+
echo "Error: at least one hostname is required."
48+
show_usage
49+
fi
50+
51+
if ! command -v dig >/dev/null 2>&1 && ! command -v nslookup >/dev/null 2>&1 && ! command -v host >/dev/null 2>&1; then
52+
echo "Error: dig, nslookup, or host command is required"
53+
exit 1
54+
fi
55+
56+
resolve_hostname() {
57+
local hostname="$1"
58+
if command -v dig >/dev/null 2>&1; then
59+
dig +short +time="$TIMEOUT" "$hostname" A 2>/dev/null | grep -E '^[0-9]+\.' | head -1
60+
elif command -v host >/dev/null 2>&1; then
61+
host -W "$TIMEOUT" "$hostname" 2>/dev/null | awk '/has address/{print $4}' | head -1
62+
else
63+
nslookup "$hostname" 2>/dev/null | awk '/^Address:/{print $2}' | tail -1
64+
fi
65+
}
66+
67+
echo "DNS lookup check — $(date '+%Y-%m-%d %H:%M:%S')"
68+
echo "-----------------------------------------------"
69+
70+
for hostname in "${HOSTNAMES[@]}"; do
71+
resolved=$(resolve_hostname "$hostname")
72+
if [[ -z "$resolved" ]]; then
73+
echo "FAIL: $hostname — could not resolve"
74+
(( ALERT_COUNT++ ))
75+
elif [[ -n "$EXPECTED_IP" && "$resolved" != "$EXPECTED_IP" ]]; then
76+
echo "MISMATCH: $hostname — resolved to $resolved (expected $EXPECTED_IP)"
77+
(( ALERT_COUNT++ ))
78+
else
79+
echo "OK: $hostname → $resolved"
80+
fi
81+
done
82+
83+
echo "-----------------------------------------------"
84+
if [[ "$ALERT_COUNT" -gt 0 ]]; then
85+
echo "Result: $ALERT_COUNT issue(s) detected"
86+
exit 1
87+
fi
88+
echo "Result: all hostnames resolved successfully"
89+
exit 0

0 commit comments

Comments
 (0)