Shell records Dangerous commands executed by the alarm system

#! /Bin/bash

Cd/u1/Operation_log/

# Format log
For I in 'LS-l | awk' {if (NR = 1) next; print $ NF }''
Do
Cat $ I | perl-pe's/\ e ([^ \ [\] | \[.*? [A-zA-Z] | \]. *? \ A) // G' | col-B>/home/Operation_filter_log/clean/$ I
Done

###--------------------------------------------------------###

# Normal commmand
Cd/home/Operation_filter_log/clean/

For j in 'LS-l | awk' {if (NR = 1) next; print $ NF }''
Do
Egrep "Script | @ $ HOSTNAME" $ j>/home/Operation_filter_log/normal/j.txt
Done

# Dangerous commmand
# If ["$ (ls-A/home/Operation_filter_log/dangerous /)"! = ""]; Then

# Ls-l/home/Operation_filter_log/dangerous/| awk '{if (NR = 1) next; print $ NF}'>/root/list.txt

Cd/home/Operation_filter_log/normal/
For k in 'LS-l | awk '{if (NR = 1) next; print $ NF }''
Do
File1 = 'LS-l/home/Operation_filter_log/dangerous/$ k | awk '{print $5 }''
Egrep-w'rm | reboot | shutdown | init | poweroff | passwd | mkfs | kill | pkill | stop | clusvcadm | fence_drac | fence_ipmilan '$ k>/dev/null

If ["$? "=" 0 "]; then
Egrep-w "Script | @ $ HOSTNAME | rm | reboot | shutdown | init | poweroff | passwd | mkfs | kill | pkill | stop | clusvcadm | fence_drac | fence_ipmilan" $ k>/ home/Operation_filter_log/dangerous/$ k
Ls-l/home/Operation_filter_log/dangerous/| awk '{if (NR = 1) next; print $ NF}'>/root/list.txt
File2 = 'LS-l/home/Operation_filter_log/dangerous/$ k | awk '{print $5 }''

Else
Exit 2
Fi
Done

If ["$ file1 "! = "$ File2"]; then
For u in 'awk-F "$ HOSTNAME-|-" '{print $2}'/root/list.txt | sort-U'
Do
Content = ('grep "$ u"/root/list.txt ')
Content_LEN =$ {# content [@]}
I = 0
While [$ I-lt $ content_LEN]
Do
/Usr/local/mysql/bin/mysql-h 192.168.177.66-uxxx-pxxx-P3306 mon-e "insert into operation_log (hostname, user, execution_time, content) values ('$ hostname',' $ U', now (), ''cat/home/Operation_filter_log/dangerous/$ {content [$ I]} '');"
Let I ++
Done
Done
Fi

Author: "linux"