EDIT: alert_max_children_abuse.sh

#!/bin/bash # Report accounts that exceed their PHP max_children at least two days in a row. HOSTNAME=$(hostname) EMAIL="sysadmin@sitioshispanos.com" LOG_SRC="/opt/cpanel/" LOG_PREFIX="ea-php" LOG_FILE="root/var/log/php-fpm/error.log" PHP_TARGET="max_children" TDAY=$(date "+%d-%b-%Y") YDAY=$(date -d "yesterday" "+%d-%b-%Y") export INFRACTORS_LOG_TDAY=$(mktemp) export INFRACTORS_LOG_YDAY=$(mktemp) for php_log in $(find $LOG_SRC -maxdepth 1 -name "$LOG_PREFIX*"); do grep $PHP_TARGET $php_log/$LOG_FILE | while read -r line; do echo $line | grep "$TDAY" | awk '{print $4,$5}' >> $INFRACTORS_LOG_TDAY echo $line | grep "$YDAY" | awk '{print $4,$5}' >> $INFRACTORS_LOG_YDAY done done sort -o $INFRACTORS_LOG_TDAY $INFRACTORS_LOG_TDAY sort -o $INFRACTORS_LOG_YDAY $INFRACTORS_LOG_YDAY comm -12 $INFRACTORS_LOG_TDAY $INFRACTORS_LOG_YDAY | uniq \ | mail -s "PHP pools abusing PHP max_children on $HOSTNAME" $EMAIL

SAVE CHANGES BACK TO DIR