OwlCyberSecurity - MANAGER

Edit File: check_haproxy_ddosdetect.sh

#!/bin/bash

# Initialize variables
status=0
verbose=0
backend_list=""
host_data_message=""
top_host=""
verbose_message=""
logged_message=""

LOGFILE="/var/log/nc_audit/haproxy_ddosdetect_check.log"

logger() {
    echo "${1}"
    echo "[$(date '+%F %T %z')] ${1}
------------------------------------" >> "${LOGFILE}"
}

# Parse command-line arguments
while getopts ":v" opt; do
    case "$opt" in
        v)
            verbose=1
            ;;
        \?)
            echo "Invalid option: -$OPTARG" >&2
            echo "Usage: $0 [-v]" >&2
            exit 1
            ;;
    esac
done

# Retrieves data about backends from HAProxy
data=$(echo "show stat" | socat /var/run/haproxy.stat stdio | awk -F',' '/BACKEND/&& $1 ~ /(back_|apache81)/{print $1,$3,$5,$62}')
data_exit_status=$?

# Check if data retrieval was successful
if [ "$data_exit_status" -ne 0 ] || [ -z "$data" ]; then
    logger "CRITICAL - Failed to retrieve HAProxy stats."
    exit 2
fi

# Read data
while read -r backend qcur scur ttime; do
    if [ -z "$backend" ] || [ -z "$qcur" ] || [ -z "$scur" ] || [ -z "$ttime" ]; then
        logger "CRITICAL - Failed to retrieve HAProxy stats: Missing data for backend '$backend'."
        exit 2
    else
        triggered=0
        backend_info="$backend: "

if [ "$ttime" -gt 11000 ]; then
            # Convert ttime from milliseconds to seconds
            ttime_sec=$(echo "scale=3; $ttime/1000" | bc | sed 's/\.\?0*$//')
            backend_info+="ttime is ${ttime_sec} seconds, "
            triggered=1
        fi

if [ "$qcur" -gt 1000 ]; then
            backend_info+="qcur is $qcur, "
            triggered=1
        fi

if [ "$scur" -gt 2000 ]; then
            backend_info+="scur is $scur, "
            triggered=1
        fi

if [ "$triggered" -eq 1 ]; then
            status=2
            # Remove trailing comma and space
            backend_info="${backend_info%, }"
            # Add backend name to backend_list
            backend_list+="$backend, "
            # Add backend_info to verbose_message
            verbose_message+="$backend_info"$'\n'
        fi
    fi
done <<< "$data"

# If any backend triggered, retrieve host data
if [ "$status" -eq 2 ]; then
    # Retrieves data about top hosts under load from HAProxy
    host_data=$(echo "show table be_counter" | socat /var/run/haproxy.stat stdio | grep -v "table: be_counter" | sed '$d' | sort -t '=' -k7,7nr | head -n 3 | awk -F '=' '{ split($2, h, " "); printf "%s: %s\n", h[1], $7 }' | column -t)
    host_data_exit_status=$?

# Check if host data retrieval was successful and set host_data_message and top_host
    if [ "$host_data_exit_status" -ne 0 ] || [ -z "$host_data" ]; then
        host_data_message="Failed to retrieve HAProxy stats regarding top hosts."
        top_host="retrieval failed :("
    else
        host_data_message="$host_data"
        top_host="${host_data_message%%:*}"
    fi
fi

# Output status for Icinga
if [ "$status" -eq 0 ]; then
    echo "OK - No backends exceed thresholds."
    exit 0
else
    logged_message="CRITICAL - Thresholds exceeded on backends:
$verbose_message
Top 3 hosts rated by http_req_rate:
$host_data_message"
    
    if [ "$verbose" -eq 1 ]; then
        logger "$logged_message"
    else
        # Remove trailing comma and space
        backend_list="${backend_list%, }"
        echo "CRITICAL - Thresholds exceeded on backends: $backend_list, top host: $top_host"
        echo "[$(date '+%F %T %z')] $logged_message
------------------------------------" >> "${LOGFILE}"
    fi
    exit 2
fi