#/bin/bash

#/usr/local/python3.9/bin/python3   /root/ai2/sub_oldip.py
reload1=$(/usr/local/python3.9/bin/python3   /root/ai2/sub_oldip.py)   ##調(diào)用python腳本，是否返回重啟
reload2=nores               ##默認(rèn)值不重啟
#echo "$reload1"
sleep 1s
my_log=/root/ai2/log.txt
#logfile=/root                     
logfile=/usr/local/tengine/logs   ##Nginx日志


confdir=/usr/local/tengine/conf/blockip.conf     ##Nginx的blockip.conf目錄
time_sjc=$(date -d  now +%s)                     ##獲取時(shí)間戳
my_log_date=`date +"%Y-%m-%d %H:%M:%S"`               ##日志記錄時(shí)間
start_time=`date -d "-5min" +"%H:%M:%S"`         ##start_time-stop_time的值為Nginx統(tǒng)計(jì)日志的時(shí)間為5分鐘
#echo "$start_time"
stop_time=`date +"%H:%M:%S"`
#echo "$stop_time"

#過(guò)濾出單位之間內(nèi)的日志并統(tǒng)計(jì)最高ip數(shù)，請(qǐng)?zhí)鎿Q為你的日志路徑
tac $logfile/host.access.log | awk -v st="$start_time" -v et="$stop_time" ' {t=substr($4,RSTART+14,21);if(t>=st && t<=et) {print $0}}' |awk '{print $1}' |grep -i -v -E "google|yahoo|baidu|msnbot|FeedSky|sogou" |sort | uniq -c | sort -nr |head -20> $logfile/log_ip_top20

ip=`cat $logfile/log_ip_top20 | awk '{if($1>50)print $2}'`    ##統(tǒng)計(jì)排名前10的ip訪問次數(shù)，100次以上加入黑名單
ip_tmp=`cat $logfile/log_ip_top20 | awk '{if($1>50)print $2}' |head -1`    ##用于if判斷去首行，多行會(huì)報(bào)錯(cuò)
##echo "$ip"

if [ "$ip_tmp" = "" ];then    ##如果ip_tmp為空，打印沒有黑名單ip
     echo "$my_log_date no black ip " >> $my_log
else
#      for line in $ip                        ##按行讀取黑名單ip，按格式加入到blockip.conf和日志
#         do
#         echo "deny $line ; # $time_sjc" >> $confdir
#         echo "$my_log_date deny $line " >> $my_log
#         done
#      #/usr/local/tengine/sbin/nginx -s reload
#      reload2=res                             ##賦值reload2 需要重啟

      for line in $ip                        ##按行讀取黑名單ip，按格式加入到blockip.conf和日志
         do
           if [ `grep -c "$line" $confdir` -eq '0' ];then
             echo "deny $line ; # $time_sjc" >> $confdir
             echo "$my_log_date deny $line " >> $my_log
             reload2=res
           else
             #line_uptime="deny $line ; # $time_sjc"
             #sed -e "s/.*'$line'.*$/$line_uptime/g" $confdir
             sed  -i /"$line"/d "$confdir"
             echo "deny $line ; # $time_sjc" >> $confdir
             echo "$my_log_date $line is in conf" >> $my_log
           fi
         done

fi
#echo  "$reload1"
#echo  "$reload2"

##如果reload1或者reload2都為res則重啟，否則不重啟；
if [ "$reload1" = "res" ] || [ "$reload2" = "res"  ];then
  /usr/local/tengine/sbin/nginx -s reload          ##替換自己的Nginx環(huán)境變量
  echo "$my_log_date Nginx  reload"  >> $my_log
else
  echo "$my_log_date Nginx no reload"  >> $my_log
fi

#!/usr/bin/python3
# chenzhenhua
import string,time,os
time_now = int(time.time())
log_time = time.strftime("%Y-%m-%d %H:%M:%S", time.localtime())
dir = "/usr/local/tengine/conf/blockip.conf"                       ##修改自己的blockip.conf地址
f_log = open("/root/ai2/log.txt","a")                ##本程序日志

with open(dir,"r",encoding="utf-8") as f:     ##讀取blockip.conf
    lines = f.readlines()
    #print(lines)
with open(dir,"w",encoding="utf-8") as f2:    ##把日期小于3600的ip重新寫入回blockip.conf
    for line in lines:
        if line == '' or line == '\n':
            continue
        else:
            old_time = int(line.strip().split()[4])    ##取第五個(gè)值，然后和現(xiàn)在時(shí)間挫進(jìn)行對(duì)比
            time_sjc = time_now -old_time
            ipadd = line.split()[1]
            if time_sjc > 3600:              ###根據(jù)要求調(diào)整秒數(shù)，秒數(shù)大于次值不再重新寫入blockip.conf
                line_log = line.strip().split()[1]
                f_log.write("%s sub %s \n"%(log_time,line_log )  )
                continue
            else:
                f2.write(line)

f2.close()
with open(dir,"r",encoding="utf-8") as f3:
    lines2 = f3.readlines()
f3.close()
#time.sleep(0.5)
if lines2 == lines:                                      ###對(duì)比新、老blockip.conf是否一致
    f_log.write("%s py over retrun nores \n" % (log_time))
 #   time.sleep(0.5)
    print('nores')                                       ##返回shell不要求重啟
else:
    f_log.write("%s py over retrun res \n" % (log_time))
 #   time.sleep(0.5)
    print('res')                                         ##返回shell不要求重啟
f_log.close()

[root@Zabbix ~]# crontab -e
*/5 * * * * /root/ai2/nginx_black.sh

 ab -c 10 -n 100 http://172.16.3.89/test2/

[root@Zabbix logs]# tail -f /root/ai2/log.txt 
2021-08-14 18:15:02 Nginx no reload
2021-08-14 18:20:01 py over retrun nores 
2021-08-14 18:20:02 no black ip 
2021-08-14 18:20:02 Nginx no reload
2021-08-14 18:25:01 py over retrun nores 
2021-08-14 18:25:02 no black ip 
2021-08-14 18:25:02 Nginx no reload
2021-08-14 18:30:01 py over retrun nores 
2021-08-14 18:30:02 deny 192.168.200.244 
2021-08-14 18:30:02 Nginx  reload

[root@Zabbix logs]# cat /usr/local/tengine/conf/blockip.conf 
deny 192.168.200.244 ; # 1628937002