==Overview==
Enter a partial date string to get top visitors during that period. Will also return site and all user agents that IP has used.
==Script==

===Standard===
<code>[bash,n]echo "Date String [31/Mar/2011:13:4]"; read datestring; \
for i in $(grep $datestring /usr/local/apache/domlogs/* | awk {'print $1'} | sort | uniq -c | sort -n | sed -e 's/^[ \t]*//' | awk '{print $1 ":" $2}' | tail -10); \
do count=`echo $i | cut -d: -f1`; \
ip=`echo $i | cut -d: -f3`; \
domain=`echo $i | cut -d: -f2`; \
agent=`grep $datestring $domain | grep $ip | cut -d '"' -f6 | sort | uniq -c | sort -n | awk {'print "\n\t" $0'}` ; \
echo -e "$count $ip $domain $agent"; done </code>

===Auto Date===
<code>[bash,n] datestring=`date | awk '{print $3 "/" $2 "/" $6 ":" $4}' | sed 's/....$//'`; \
for i in $(grep $datestring /usr/local/apache/domlogs/* | awk {'print $1'} | sort | uniq -c | sort -n | sed -e 's/^[ \t]*//' | awk '{print $1 ":" $2}' | tail -10); \
do count=`echo $i | cut -d: -f1`; \
ip=`echo $i | cut -d: -f3`; \
domain=`echo $i | cut -d: -f2`; \
agent=`grep $datestring $domain | grep $ip | cut -d '"' -f6 | sort | uniq -c | sort -n | awk {'print "\n\t" $0'}` ; \
echo -e "$count $ip $domain $agent"; done </code>

===Auto Date (Minus 10m)===
<code>[bash,n] datestring=`date -d "10 min ago" | awk '{print $3 "/" $2 "/" $6 ":" $4}' | sed 's/....$//'`; \
for i in $(grep $datestring /usr/local/apache/domlogs/* | awk {'print $1'} | sort | uniq -c | sort -n | sed -e 's/^[ \t]*//' | awk '{print $1 ":" $2}' | tail -10); \
do count=`echo $i | cut -d: -f1`; \
ip=`echo $i | cut -d: -f3`; \
domain=`echo $i | cut -d: -f2`; \
agent=`grep $datestring $domain | grep $ip | cut -d '"' -f6 | sort | uniq -c | sort -n | awk {'print "\n\t" $0'}` ; \
echo -e "$count $ip $domain $agent"; done </code>

==What to change==

Datestring

The less information you put in to this the wider the search area.

31/Mar/2011:13:4 will return 13:40 - 13:49

31/Mar/2011:13 will return 13:00 - 13:59

Also the auto date (minus 10m) can be changed to go back a certain amount of time.

By default this still only shows a 10 minute period.

View Domlogs for top visitors

2011-05-19T17:51:35Z

10.30.6.195: /* What to change */

Hacker Term Search

2011-05-19T12:47:04Z

10.30.6.195: Created page with "==Overview== Simple find statement coupled with a grep statement. Will return path of any file containing these terms. ==Script== <code>[bash,n] find /home*/ -type f -name "*..."

==Overview==
Simple find statement coupled with a grep statement. Will return path of any file containing these terms.

==Script==

<code>[bash,n]
find /home*/ -type f -name "*.htm*" -o -type f -name "*.php" -print0 | xargs -0 grep -il "hacked by\|script kitten" >> malware_hits.txt
</code>

==What to change==

Change the terms in the grep statement.

Hacked by is the most common, Kittens use the same terms on all of their pages. No need to be original.

Additional terms can be added if looking for a specific hacker group.

Main Page

2011-05-19T12:43:26Z

10.30.6.195: /* Scripts (one liners) */

==Knowledge==
[[Monitorix Install cPanel]]

==Scripts (one liners)==
[[Add PHP.ini to user directory]]

[[DOS IP with local port]]

[[Find all backups for user]]

[[Get status of MalDet hits]]

[[View Domlogs for top visitors]]

[[Hacker Term Search]]

==Programs (more then one line)==
[[SwapClean]]

[[errornotify]]

[[ministat]]

==Greasy Monkey (GreaseMonkey Scripts)==
[[HD Button Remove]]

[[Not So Important]]

[[Side Bar Color Fixer]]

==Misc Script Fu==
[[count*.gif? detection and removal]]

==Scripts by Others==
[[MySQL Memory Usage]]

[[MySQL Memory Usage Verbose]]

==Solutions (Multi Step)==

[[MySQL Import Progress]]

Ministat

2011-05-18T13:30:01Z

10.30.6.195: /* Credits */

==Overview==

Perl script to calculate MySQL max memory allotment.

Modified original code to search for cPanel defaults.

==Script==

<code>[perl,n]
#!/usr/bin/perl -w
#
# calculate mysqld memory consumption from my.cnf
# usage: mysql-memory-usage /path/to/my.cnf [/path/to/mysqld]
#
# $Id: mysql-memory-usage 228 2010-05-31 10:53:33Z schwenke $

my $mycnf= shift;
$mycnf= "/etc/my.cnf" unless $mycnf;
die "cannot read $mycnf\n" unless (-r $mycnf);

my $mysqld= shift;
unless ($mysqld) {
# find mysqld relative to mysql
$mysqld= `which mysqld` or die;
chomp $mysqld;
$mysqld =~ s(bin/mysql$)(libexec/mysqld);
}
die "cannot execute $mysqld\n" unless (-x $mysqld);

# read configuration
my %conf;
open M, "$mysqld --defaults-file=$mycnf --help --verbose |" or die;
while (<M>) { # skip to parameter list
last if (/^\-{5,} \-{5,}$/o);
}
while (<M>) {
last if /^$/o;
my ($var, $val)= split;
$conf{$var}= $val;
}
close M;

# static memory consumption
my $static= $conf{'key_buffer_size'} + $conf{'query_cache_size'};
# has innodb
$static+= $conf{'innodb-buffer-pool-size'} + $conf{'innodb-log-buffer-size'}
+ $conf{'innodb-additional-mem-pool-size'} if (($conf{'innodb'} eq 'TRUE') or ($conf{'innodb'} eq 'ON'));

# per thread memory consumption
my $thread= $conf{'thread_stack'}
+ 2*$conf{'net_buffer_length'} + $conf{'read_buffer_size'}
+ $conf{'read_rnd_buffer_size'} + $conf{'sort_buffer_size'};

# writes binlog
$thread += $conf{'binlog_cache_size'} if ($conf{'log-bin'} ne '(No');

# MyISAM repair thread(s)
my $repair= 0;
$repair+= $conf{'myisam_repair_threads'} * $conf{'myisam_sort_buffer_size'}
if ($conf{'myisam-recover'} ne 'OFF');

# Memory (HEAP) tables
my $heaptables= $conf{'max_heap_table_size'};

# temp. tables
my $tmptables= min($conf{'tmp_table_size'}, $conf{'max_heap_table_size'});

#
# show result
#
print "$mysqld will use at most:\n";
printf "%-10s for global stuff\n", p($static);
printf "%-10s per thread\n", p($thread);
printf "%-10s total (with %d active threads)\n",
p($static + $conf{'max_connections'}*$thread), $conf{'max_connections'};
print "and additionally:\n";
printf "%-10s while recovering MyISAM tables\n", p($repair) if ($repair);
printf "%-10s for each HEAP table\n", p($heaptables);
printf "%-10s for each temporary table\n", p($tmptables);
exit 0;

sub min {
my ($a, $b)= @_;
return $a <$b ? $a : $b;
}

sub p {
my $n= shift;
my $prefix= 0;
while ($n >= 1024 && $prefix < 5) {
$n/= 1024;
$prefix++;
}
sprintf $prefix?"%.1f %s":"%d %s", $n, qw"Bytes KB MB GB TB"[$prefix];
}
</code>

==Usage==

Default

<code>[bash,n]perl sqlmem.pl</code>

Defaults will use the cpanel default MySQL locations.

Specify paths

<code>[bash,n]perl sqlmem.pl [/path/to/my.cnf] [/path/to/mysqld]</code>

==Credits==

Original code created by:

Axel Schwenke:

http://forge.mysql.com/tools/tool.php?id=266

MySQL Memory Usage

2011-05-03T14:53:20Z

10.30.6.195: /* What to change */

==Overview==

Perl script to calculate MySQL max memory allotment.

Modified original code to search for cPanel defaults.

==Script==

<code>[perl,n]
#!/usr/bin/perl -w
#
# calculate mysqld memory consumption from my.cnf
# usage: mysql-memory-usage /path/to/my.cnf [/path/to/mysqld]
#
# $Id: mysql-memory-usage 228 2010-05-31 10:53:33Z schwenke $

my $mycnf= shift;
$mycnf= "/etc/my.cnf" unless $mycnf;
die "cannot read $mycnf\n" unless (-r $mycnf);

my $mysqld= shift;
unless ($mysqld) {
# find mysqld relative to mysql
$mysqld= `which mysqld` or die;
chomp $mysqld;
$mysqld =~ s(bin/mysql$)(libexec/mysqld);
}
die "cannot execute $mysqld\n" unless (-x $mysqld);

# read configuration
my %conf;
open M, "$mysqld --defaults-file=$mycnf --help --verbose |" or die;
while (<M>) { # skip to parameter list
last if (/^\-{5,} \-{5,}$/o);
}
while (<M>) {
last if /^$/o;
my ($var, $val)= split;
$conf{$var}= $val;
}
close M;

# static memory consumption
my $static= $conf{'key_buffer_size'} + $conf{'query_cache_size'};
# has innodb
$static+= $conf{'innodb-buffer-pool-size'} + $conf{'innodb-log-buffer-size'}
+ $conf{'innodb-additional-mem-pool-size'} if (($conf{'innodb'} eq 'TRUE') or ($conf{'innodb'} eq 'ON'));

# per thread memory consumption
my $thread= $conf{'thread_stack'}
+ 2*$conf{'net_buffer_length'} + $conf{'read_buffer_size'}
+ $conf{'read_rnd_buffer_size'} + $conf{'sort_buffer_size'};

# writes binlog
$thread += $conf{'binlog_cache_size'} if ($conf{'log-bin'} ne '(No');

# MyISAM repair thread(s)
my $repair= 0;
$repair+= $conf{'myisam_repair_threads'} * $conf{'myisam_sort_buffer_size'}
if ($conf{'myisam-recover'} ne 'OFF');

# Memory (HEAP) tables
my $heaptables= $conf{'max_heap_table_size'};

# temp. tables
my $tmptables= min($conf{'tmp_table_size'}, $conf{'max_heap_table_size'});

#
# show result
#
print "$mysqld will use at most:\n";
printf "%-10s for global stuff\n", p($static);
printf "%-10s per thread\n", p($thread);
printf "%-10s total (with %d active threads)\n",
p($static + $conf{'max_connections'}*$thread), $conf{'max_connections'};
print "and additionally:\n";
printf "%-10s while recovering MyISAM tables\n", p($repair) if ($repair);
printf "%-10s for each HEAP table\n", p($heaptables);
printf "%-10s for each temporary table\n", p($tmptables);
exit 0;

sub min {
my ($a, $b)= @_;
return $a <$b ? $a : $b;
}

sub p {
my $n= shift;
my $prefix= 0;
while ($n >= 1024 && $prefix < 5) {
$n/= 1024;
$prefix++;
}
sprintf $prefix?"%.1f %s":"%d %s", $n, qw"Bytes KB MB GB TB"[$prefix];
}
</code>

==Usage==

Default

<code>[bash,n]perl sqlmem.pl</code>

Defaults will use the cpanel default MySQL locations.

Specify paths

<code>[bash,n]perl sqlmem.pl [/path/to/my.cnf] [/path/to/mysqld]</code>

==Credits==

MySQL Memory Usage

2011-05-03T14:50:32Z

10.30.6.195: /* Overview */

==Overview==

Perl script to calculate MySQL max memory allotment.

Modified original code to search for cPanel defaults.

==Script==

<code>[perl,n]
#!/usr/bin/perl -w
#
# calculate mysqld memory consumption from my.cnf
# usage: mysql-memory-usage /path/to/my.cnf [/path/to/mysqld]
#
# $Id: mysql-memory-usage 228 2010-05-31 10:53:33Z schwenke $

my $mycnf= shift;
$mycnf= "/etc/my.cnf" unless $mycnf;
die "cannot read $mycnf\n" unless (-r $mycnf);

my $mysqld= shift;
unless ($mysqld) {
# find mysqld relative to mysql
$mysqld= `which mysqld` or die;
chomp $mysqld;
$mysqld =~ s(bin/mysql$)(libexec/mysqld);
}
die "cannot execute $mysqld\n" unless (-x $mysqld);

# read configuration
my %conf;
open M, "$mysqld --defaults-file=$mycnf --help --verbose |" or die;
while (<M>) { # skip to parameter list
last if (/^\-{5,} \-{5,}$/o);
}
while (<M>) {
last if /^$/o;
my ($var, $val)= split;
$conf{$var}= $val;
}
close M;

# static memory consumption
my $static= $conf{'key_buffer_size'} + $conf{'query_cache_size'};
# has innodb
$static+= $conf{'innodb-buffer-pool-size'} + $conf{'innodb-log-buffer-size'}
+ $conf{'innodb-additional-mem-pool-size'} if (($conf{'innodb'} eq 'TRUE') or ($conf{'innodb'} eq 'ON'));

# per thread memory consumption
my $thread= $conf{'thread_stack'}
+ 2*$conf{'net_buffer_length'} + $conf{'read_buffer_size'}
+ $conf{'read_rnd_buffer_size'} + $conf{'sort_buffer_size'};

# writes binlog
$thread += $conf{'binlog_cache_size'} if ($conf{'log-bin'} ne '(No');

# MyISAM repair thread(s)
my $repair= 0;
$repair+= $conf{'myisam_repair_threads'} * $conf{'myisam_sort_buffer_size'}
if ($conf{'myisam-recover'} ne 'OFF');

# Memory (HEAP) tables
my $heaptables= $conf{'max_heap_table_size'};

# temp. tables
my $tmptables= min($conf{'tmp_table_size'}, $conf{'max_heap_table_size'});

#
# show result
#
print "$mysqld will use at most:\n";
printf "%-10s for global stuff\n", p($static);
printf "%-10s per thread\n", p($thread);
printf "%-10s total (with %d active threads)\n",
p($static + $conf{'max_connections'}*$thread), $conf{'max_connections'};
print "and additionally:\n";
printf "%-10s while recovering MyISAM tables\n", p($repair) if ($repair);
printf "%-10s for each HEAP table\n", p($heaptables);
printf "%-10s for each temporary table\n", p($tmptables);
exit 0;

sub min {
my ($a, $b)= @_;
return $a <$b ? $a : $b;
}

sub p {
my $n= shift;
my $prefix= 0;
while ($n >= 1024 && $prefix < 5) {
$n/= 1024;
$prefix++;
}
sprintf $prefix?"%.1f %s":"%d %s", $n, qw"Bytes KB MB GB TB"[$prefix];
}
</code>

==What to change==

==Credits==