#encoding: utf-8
#!/bin/bash

##demo
##checklist
##date: 2020-09-16
##cunzhang

savePath=/tmp/.opstools.cache && mkdir -p $savePath
timeFlag=`date +%s`
localUser=$(whoami)
logFile=/dev/null
function printHelp {
echo "
Usage :      参数不能为空
  help:      打印此帮助信息
  desc:      打印检测项说明文档
  checklist: 执行checklist，执行前需满足：
             1.工具机已安装sshpass或yum可用，工具会尝试yum自主安装;
	     2.工具机到节点ssh网络畅通;
	     3.运维用户在每个节点已存在并知晓密码;
	     4.运维用户在每个节点有sudo权限;
       5.如使用非root用户，且不能提供密码，需提前配置ssh免密以及sudo免密
  repair:    根据checklist结果，修复异常条目
"

}

function printDesc {
  echo ""
  echo -e "\e[1;4m`printf "%-100s\n" "                                   检测说明文档"`\e[0m"
  echo -e "|\e[1;4m`printf "%25s|%8s| %-67s\n" "检测项" "检测方式"        "检测说明"`\e[0m|"
  echo -e "\e[4m`printf "|%26s|%8s| %-67s|\n" "系统厂商" "SSH"           "目前支持CentOs,RedHat"`\e[0m"
  echo -e "\e[4m`printf "|%26s|%8s| %-72s|\n" "系统版本" "SSH"           "目前支持7.2及以上版本"`\e[0m"
  echo -e "\e[4m`printf "|%27s|%8s| %-75s|\n" "系统主机名" "SSH"         "不支持系统默认localhost作为主机名"`\e[0m"
  echo -e "\e[4m`printf "|%26s|%8s| %-69s|\n" "系统时区" "SSH"           "建议配置【+0800】"`\e[0m"
  echo -e "\e[4m`printf "|%24s|%8s| %-75s|\n" "系统HugePageDefrag"       "SSH" "检测大页内存配置,建议关闭"`\e[0m"
  echo -e "\e[4m`printf "|%24s|%8s| %-75s|\n" "系统HugePageEnabled"      "SSH" "检测大页内存配置,建议关闭"`\e[0m"
  echo -e "\e[4m`printf "|%26s|%8s| %-82s|\n" "运维用户" "SSH"           "运维操作使用的用户,检测是否存在且有sudo权限"`\e[0m"
  echo -e "\e[4m`printf "|%26s|%8s| %-75s|\n" "运维用户Umask" "SSH"      "运维用户,检测umask设置,建议值:root[0022],非root[0002]"`\e[0m"
  echo -e "\e[4m`printf "|%26s|%8s| %-89s|\n" "应用用户" "SSH"           "应用使用的用户,检测是否存在.建议使用普通用户,并限制权限"`\e[0m"
  echo -e "\e[4m`printf "|%26s|%8s| %-74s|\n" "应用用户Umask" "SSH"      "应用用户,检测umask设置.建议值:[0002]"`\e[0m"
  echo -e "\e[4m`printf "|%26s|%8s| %-77s|\n" "磁盘挂载" "SSH"           "检测当前挂载配置是否已经写入/etc/fstab"`\e[0m"
  echo -e "\e[4m`printf "|%26s|%8s| %-73s|\n" "数据目录" "SSH"           "检测数据目录是否存在"`\e[0m"
  echo -e "\e[4m`printf "|%28s|%8s| %-90s|\n" "数据目录挂载" "SSH"       "检测数据目录是否单独挂载存储设备，建议数据保存在数据盘"`\e[0m"
  echo -e "\e[4m`printf "|%24s|%8s| %-78s|\n" "YUM检测" "SSH"            "检测yum命令是否可用,系统源是否有效"`\e[0m"
  echo -e "\e[4m`printf "|%28s|%8s| %-79s|\n" "时间服务检测" "SSH"       "检测时间服务是否配置且服务端正常"`\e[0m"
  echo -e "\e[4m`printf "|%24s|%8s| %-84s|\n" "内核:swappiness" "SSH"    "检测交互分区的使用比重，建议设置为0,不应超过10"`\e[0m"
  echo -e "\e[4m`printf "|%24s|%8s| %-84s|\n" "内核:max_map_count" "SSH" "检测进程可用虚拟内存区域数量,建议设置不低于6553500"`\e[0m"
  echo -e "\e[4m`printf "|%24s|%8s| %-82s|\n" "内核:file-max" "SSH"      "检测系统可用的文件句柄数,建议设置不低于100000000"`\e[0m"
  echo -e "\e[4m`printf "|%24s|%8s| %-86s|\n" "内核:nr_open" "SSH"       "检测单进程可用的文件句柄上限配置,建议设置不低于10240000"`\e[0m"
  echo -e "\e[4m`printf "|%24s|%8s| %-83s|\n" "内核:somaxconn" "SSH"     "检测单一TCP连接的侦听队列长度,建议设置不低于1024"`\e[0m"
  echo -e "\e[4m`printf "|%24s|%8s| %-78s|\n" "内核:ip_forward" "SSH"    "检测是否开启了IP转发,建议设置开启"`\e[0m"
#  echo -e "\e[4m`printf "|%21s|%8s| %-76s|\n" "内核:overcommit_memory" "SSH"    "检测内存申请模式,建议设置为1"`\e[0m"
  echo -e "\e[4m`printf "|%22s|%8s| %-84s|\n" "limits:nofile" "SSH"      "检测应用用户进程可用文件句柄数,建议不低于100000,小于nr_open限制"`\e[0m"
  echo -e "\e[4m`printf "|%22s|%8s| %-81s|\n" "limits:nproc" "SSH"       "检测应用用户可创建的进程数,建议不低于65535"`\e[0m"
#  echo -e "\e[4m`printf "|%22s|%8s| %-83s|\n" "limits:memlock" "SSH"       "检测应用用户可锁定内存空间大小,建议不限制"`\e[0m"
  echo -e "\e[4m`printf "|%24s|%8s| %-77s|\n" "网络:NicMTU" "SSH"        "检测网卡配置的MTU值，标准配置为1500"`\e[0m"
  echo -e "\e[4m`printf "|%27s|%8s| %-84s|\n" "安全:防火墙" "SSH"        "检测防火墙配置,建议:关闭,如开启,需额外配置规则"`\e[0m"
  echo -e "\e[4m`printf "|%24s|%8s| %-71s|\n" "安全:Selinux" "SSH"       "检测Selinux配置,建议:关闭"`\e[0m"
  echo -e "\e[4m`printf "|%30s|%8s| %-78s|\n" "差异性:主机名比对" "SSH"  "检测集群中节点,主机名配置不重复"`\e[0m"
  echo -e "\e[4m`printf "|%29s|%8s| %-77s|\n" "差异性:时区比对" "SSH"    "检测集群中节点,使用相同的时区"`\e[0m"
  echo -e "\e[4m`printf "|%29s|%8s| %-82s|\n" "差异性:时间比对" "SSH"    "检测集群中节点,时间是否一致，差值不高于5s"`\e[0m"
  echo ""

}

function log_info {
  echo -e "`date '+%Y-%m-%d %H:%M:%S'` \e[1;32m INFO \e[0m $1"
  echo -e "`date '+%Y-%m-%d %H:%M:%S'` \e[1;32m INFO \e[0m $1" >>$logFile
}
function log_warn {
  echo -e "`date '+%Y-%m-%d %H:%M:%S'` \e[1;33m WARNING \e[0m $1"
  echo -e "`date '+%Y-%m-%d %H:%M:%S'` \e[1;33m WARNING \e[0m $1" >>$logFile
}
function log_crit {
  echo -e "`date '+%Y-%m-%d %H:%M:%S'` \e[1;31m CRITICAL \e[0m $1"
  echo -e "`date '+%Y-%m-%d %H:%M:%S'` \e[1;31m CRITICAL \e[0m $1" >>$logFile
  printHelp
}

function log_info_noDate {
  echo -e "\e[1;32mINFO     \e[0m $1"
  echo -e "\e[1;32mINFO     \e[0m $1" >>$logFile
}
function log_warn_noDate  {
  [ -z "$2" ] && echo -e "\e[1;33mWARNING\e[0m  \e[33m $1\e[0m" && echo -e "\e[1;33mWARNING\e[0m  \e[33m $1\e[0m" >>$logFile
  [ -n "$2" ] && echo -e "\e[1;33mWARNING\e[0m  \e[33m $2\e[0m" && echo -e "\e[1;33mWARNING\e[0m  \e[33m $2\e[0m" >>$logFile
  [ -n "$2" ] && keyName=$(echo $2|awk '{print $1}')
  [ -n "$2" ] && echo "$keyName $1" >> ${savePath}/checkResult.${timeFlag}
}
function log_crit_noDate {
  echo -e "\e[1;31mCRITICAL\e[0m\e[31m  $1\e[0m"
  echo -e "\e[1;31mCRITICAL\e[0m\e[31m  $1\e[0m" >>$logFile
}

function whileSshCheckList {
  fileName=$1
  cmd=$2
  checkFlag=""
  while read line ;do
    check=`$sshHeader $line "$cmd" >>$logFile 2>&1`
    if [[ $? -ne 0 ]];then
      checkFlag="$checkFlag $line"
    fi
  done < $fileName
  echo $checkFlag
}

function checkSystemMount {
  flag=0
  count=0
  for i in $1;do
    count=`expr $count + 1`
    for j in $2;do
      if [[ "$i" == "$j" ]];then
        flag=`expr $flag + 1`
      fi
    done
    if [[ $count -ne $flag  ]];then
      failList="$failList $i"
      flag=`expr $flag + 1`
    fi
  done
  echo $failList
}

repair_sysctl(){
  sysctlKey=$1
  sysctlVal=$2
  sysctlTag=$($sshHeader $host "cat /etc/sysctl.conf|grep '^#repairTask'|wc -l" 2>>$logFile)
  [ $sysctlTag -eq 0 ] && sysctls=$($sshHeader $host "${sudoCmd} sed -i '\$a #repairTask' /etc/sysctl.conf" >>$logFile 2>&1)

  sysctls=$($sshHeader $host "${sudoCmd} sed -i \"/#repairTask/a $sysctlKey=$sysctlVal\" /etc/sysctl.conf" >>$logFile 2>&1)
  sysctls=$($sshHeader $host "${sudoCmd} sysctl -p -q 2>&1")
  [ -z "$sysctls" ] && \
  log_info_noDate "`printf "%s\t%s\t\t%s\n" [成功] $host $checkPoint`" ||\
  log_crit_noDate "`printf "%s\t%s\t\t%s\n" [失败] $host $checkPoint`"

}

function init_local {
  cmd=`sshpass -V >>$logFile 2>&1`
  sshpassStatus=$?
  if [[ "$localUser" != "root" ]];then
    if [[ $sshpassStatus -ne 0 ]];then 
      read -s -p "`echo -e "\e[35m请输入当前用户${localUser}的密码:\e[0m"`" localPasswd
      echo ""
      if [[ -z "$localPasswd" ]];then
        cmd=$(sudo yum install sshpass -y >>$logFile 2>&1)
	      [[ $? -ne 0 ]] && log_crit "依赖工具sshpass无法安装，本地yum异常，程序退出" && exit 1
      else
        cmd=$(echo "$localPasswd"|sudo -S yum install sshpass -y >>$logFile 2>&1) 
        [[ $? -ne 0 ]] && log_crit "依赖工具sshpass无法安装，本地yum异常，程序退出" && exit 1 
      fi
    fi
  else
    if [[ $sshpassStatus -ne 0 ]];then 
      cmd=`yum install sshpass -y >>$logFile 2>&1`
      [[ $? -ne 0 ]] && log_crit "依赖工具sshpass无法安装，本地yum异常，程序退出" && exit 1 
    fi
  fi
}

function init_remote {
  read -p "`echo -e "\e[35m请输入节点运维用户,需sudo权限(默认同当前执行用户:[$localUser])：\e[0m"`" remoteOpsUser
  if [[ -z "$remoteOpsUser" ]];then
    remoteOpsUser=$localUser
  fi
  read -s -p "`echo -e "\e[35m请输入节点运维用户密码(为空尝试直接SSH)：\e[0m"`" remoteOpsPasswd
  echo ""
  read -p "`echo -e "\e[35m请输入应用启动用户(建议与运维用户区分且无sudo权限,默认[deploy])：\e[0m"`" remoteAppUser
  if [[ -z "$remoteAppUser" ]];then
    remoteAppUser="deploy"
  fi
  sshHeader="ssh -n -l $remoteOpsUser -o ConnectTimeout=5 -o StrictHostKeyChecking=no"
  [ -n "$remoteOpsPasswd" ] && init_local && \
  sshHeader="sshpass -p $remoteOpsPasswd ssh -n -l $remoteOpsUser -o ConnectTimeout=5 -o StrictHostKeyChecking=no"

  sudoCmd="sudo "
  [ "$remoteOpsUser" != "root" ] && [ -n "$remoteOpsPasswd" ] && sudoCmd="echo ${remoteOpsPasswd}|sudo -S ls >/dev/null 2>&1 && sudo "
  [ "$remoteOpsUser" == "root" ] && sudoCmd=""

}
function getInfo {
  read -p "`echo -e "\e[35m请输入包含主机列表的文件位置(./ip.list)：\e[0m"`" ipListFile
  if [[ -z "$ipListFile" ]];then
    ipListFile="./ip.list"
  fi
  if [[ -f $ipListFile  ]] && [[ -r $ipListFile ]] && [[ -s $ipListFile ]];then
    continue
  else
    log_crit "主机列表文件检测：失败，该文件需可读且不能为空."
    exit 1
  fi
  init_remote
  while read line;do
    echo
    echo -e "\e[1;36m`printf "%s"       「$line」`\e[0m"
    hn=$($sshHeader $line "hostname")
    log_info_noDate "\e[1;36m`printf "%s" 主机名`\e[0m"
    printf "$hn\n"
    mem=$($sshHeader $line "free -h")
    log_info_noDate "\e[1;36m`printf "%s" 内存`\e[0m"
    printf "$mem\n"
    cpu=$($sshHeader $line "lscpu|head -n 4")
    log_info_noDate "\e[1;36m`printf "%s" CPU`\e[0m"
    printf "$cpu\n"
    disk=$($sshHeader $line "lsblk -nlp|grep disk |awk '{print \$1,\$4}'")
    log_info_noDate "\e[1;36m`printf "%s" 磁盘信息\(非挂载信息\)`\e[0m"
    printf "$disk\n"
    diskmount=$($sshHeader $line "df -Th |grep '^\/'")
    log_info_noDate "\e[1;36m`printf "%s" 磁盘信息\(已挂载信息\)`\e[0m"
    echo -e "$diskmount\n"
    nets=$($sshHeader $line "$sudoCmd ifconfig|grep -E 'RUNNING.*mtu.*1500' -A 2|grep -E 'inet' -C 1")
    log_info_noDate "\e[1;36m`printf "%s" 网卡\(已运行\)`\e[0m"
    printf "$nets\n"
  
  done < $ipListFile

}

function checkList {
  read -p "`echo -e "\e[35m请输入包含主机列表的文件位置(./ip.list)：\e[0m"`" ipListFile
  if [[ -z "$ipListFile" ]];then
    ipListFile="./ip.list"
  fi
  if [[ -f $ipListFile  ]] && [[ -r $ipListFile ]] && [[ -s $ipListFile ]];then
    continue
  else
    log_crit "主机列表文件检测：失败，该文件需可读且不能为空."
    exit 1
  fi
  read -p "`echo -e "\e[35m请输入数据盘挂载目录(默认[/data])：\e[0m"`" remoteDataDir
  if [[ -z "$remoteDataDir" ]];then
    remoteDataDir="/data"
  fi
  sshCheck1=`whileSshCheckList $ipListFile "ls"`
  if [[ -n "$sshCheck1" ]];then
    log_crit "节点ssh通道检测：失败，列表：$sshCheck1"
    exit 1
  fi
  
  if [[ "$remoteOpsUser" != "root" ]];then
    sshCheck1=`whileSshCheckList $ipListFile "$sudoCmd ls"`
    if [[ -n "$sshCheck1" ]];then
      log_crit "节点sudo权限检测：失败，列表：$sshCheck1"
      exit 1
    fi
  fi
  
  echo -e "\n\n\n"
  log_info_noDate "\e[1;36m`printf "%s"       「节点检测报告」`\e[0m"
  while read line;do
    #系统基本信息
    log_info_noDate "\e[1;31m$line \e[0m"
    log_info_noDate "`printf "%s\t\t\t%s\t\t\t%s\n" 检测项 预期值 当前值`"
    systemName=$($sshHeader $line "cat /etc/os-release|grep \"^NAME\"|awk -F  '=' '{print \$NF}'|tr '[a-z]' '[A-Z]'")
    systemName=$(echo ${systemName//\"/})
    if [[ "$systemName" =~ "CENTOS" ]] || [[ "$systemName" =~ "REDHAT" ]] || [[ "$systemName" =~ "RED HAT" ]];then
      log_info_noDate "`printf "%s\t\t\t%s\t\t%s\n" 系统厂商  CENTOS\|REDHAT \"$systemName\"`"
      systemVersion=$($sshHeader $line "cat /etc/redhat-release|sed -e \"s/.*release[[:blank:]]*\([[:digit:]][[:graph:]]*\).*/\1/\"")
      systemVersion=$(echo $systemVersion|awk -F '.' '{print $1"."$2}')
      if [[ `expr $systemVersion \> 7.1` -eq 1 ]];then
        log_info_noDate "`printf "%s\t\t\t%s\t\t\t%s\n" 系统版本  \">=7.2\" \"$systemVersion\"`"
      else
        log_warn_noDate  $line "`printf "%s\t\t\t%s\t\t\t%s\n" 系统版本  \">=7.2\" \"$systemVersion\"`"
      fi
    else
      log_warn_noDate  $line "`printf "%s\t\t\t%s\t\t%s\n" 系统厂商  CENTOS\|REDHAT \"$systemName\"`"
      log_warn_noDate  $line "`printf "%s\t\t\t%s\t\t%s\n" 系统版本  \">=7.2\" NULL`"
    fi
  
    systemHostName=$($sshHeader $line "hostname" 2>>$logFile)
    [ "$systemHostName" == "localhost" -o "$systemHostName" == "localhost.localdomain" ] && \
    log_warn_noDate  $line "`printf "%s\t\t\t%s\t\t%s\n" 系统主机名  \"!=localhost\" \"$systemHostName\"`" || \
    log_info_noDate "`printf "%s\t\t\t%s\t\t%s\n" 系统主机名  \"!=localhost\" \"$systemHostName\"`" 
  
    systemTimeZone=$($sshHeader $line "date -R |awk '{print \$NF}'" 2>>$logFile)
    [ "$systemTimeZone" != "+0800" ] && \
    log_warn_noDate  $line "`printf "%s\t\t\t%s\t\t%s\n" 系统时区  \"==[+0800]\" \"$systemTimeZone\"`" || \
    log_info_noDate "`printf "%s\t\t\t%s\t\t%s\n" 系统时区  \"==[+0800]\" \"$systemTimeZone\"`" 

    #hugepage
    systemHugepageDefrag=$($sshHeader $line "${sudoCmd} cat /sys/kernel/mm/transparent_hugepage/defrag" 2>>$logFile)
    systemHugepageDefrag=$(echo $systemHugepageDefrag|awk -F '[' '{print $2}'|awk -F ']' '{print $1}')
    [  "$systemHugepageDefrag" != "never" ] && \
    log_warn_noDate  $line "`printf "%s\t\t%s\t\t\t%s\n" 系统HugePageDefrag \"never\" \"$systemHugepageDefrag\"`" || \
    log_info_noDate "`printf "%s\t\t%s\t\t\t%s\n" 系统HugePageDefrag \"never\" \"$systemHugepageDefrag\"`" 
    systemHugepageEnabled=$($sshHeader $line "${sudoCmd} cat /sys/kernel/mm/transparent_hugepage/enabled " 2>>$logFile)
    systemHugepageEnabled=$(echo $systemHugepageEnabled|awk -F '[' '{print $2}'|awk -F ']' '{print $1}')
    [  "$systemHugepageEnabled" != "never" ] && \
    log_warn_noDate  $line "`printf "%s\t\t%s\t\t\t%s\n" 系统HugePageEnabled \"never\" \"$systemHugepageEnabled\"`" || \
    log_info_noDate "`printf "%s\t\t%s\t\t\t%s\n" 系统HugePageEnabled \"never\" \"$systemHugepageEnabled\"`" 
  
  
    log_info_noDate "`printf "%s\t\t\t%s\t\t%s\n" 运维用户  \"Exist&&Sudo\" \"Exist&&Sudo\"`"
  
    userUmaskOps=$($sshHeader $line "${sudoCmd} su - $remoteOpsUser -c  \"umask\"" 2>>$logFile)
    if [ "$remoteOpsUser" == "root" ];then
      [[ "$userUmaskOps" != "0022"  ]] && \
      log_warn_noDate  $line "`printf "%s\t\t\t%s\t\t\t%s\n" 运维用户Umask  \"0022\" \"$userUmaskOps\"`" || \
      log_info_noDate "`printf "%s\t\t\t%s\t\t\t%s\n" 运维用户Umask  \"0022\" \"$userUmaskOps\"`" 
    else
      [[ "$userUmaskOps" != "0002"  ]] && \
      log_warn_noDate  $line "`printf "%s\t\t\t%s\t\t\t%s\n" 运维用户Umask  \"0002\" \"$userUmaskOps\"`" || \
      log_info_noDate "`printf "%s\t\t\t%s\t\t\t%s\n" 运维用户Umask  \"0002\" \"$userUmaskOps\"`" 
    fi
    systemAppUser=$($sshHeader $line "id $remoteAppUser" >>$logFile 2>&1)
    appUserIsExist=$?
    [ $appUserIsExist -ne 0 ] && \
    log_warn_noDate  $line "`printf "%s\t\t\t%s\t\t\t%s\n" 应用用户  \"EXIST\" \"NOT EXIST\"`" || \
    log_info_noDate "`printf "%s\t\t\t%s\t\t\t%s\n" 应用用户  \"EXIST\" \"EXIST\"`"
    if [ $appUserIsExist -eq 0 ];then
      userUmaskApp=$($sshHeader $line "${sudoCmd} su - $remoteAppUser -c  \"umask\"" 2>>$logFile)
      [[ "$userUmaskApp" != "0002"  ]] && \
      log_warn_noDate  $line "`printf "%s\t\t\t%s\t\t\t%s\n" 应用用户Umask  \"0002\" \"$userUmaskApp\"`" || \
      log_info_noDate "`printf "%s\t\t\t%s\t\t\t%s\n" 应用用户Umask  \"0002\" \"$userUmaskApp\"`" 
    else
      log_warn_noDate  $line "`printf "%s\t\t\t%s\t\t\t%s\n" 应用用户Umask  \"0002\" \"No User\"`" 
    fi
  
    systemDfMount=$($sshHeader $line "${sudoCmd} df -h |grep '^/dev/'|awk '{print \$NF}'" 2>>$logFile)
    systemFstabMount=$($sshHeader $line "${sudoCmd} cat /etc/fstab |grep -v '^#' |grep -v '^$'|awk '{print \$2}'" 2>>$logFile)
    failMountList=$(checkSystemMount "$systemDfMount" "$systemFstabMount")
    [ -n "$failMountList" ] && \
    log_warn_noDate  $line "`printf "%s\t\t\t%s\t\t%s\n" 磁盘挂载  \"永久挂载\" \"临时挂载\"`" || \
    log_info_noDate "`printf "%s\t\t\t%s\t\t%s\n" 磁盘挂载  \"永久挂载\" \"永久挂载\"`"
    systemDataDir=$($sshHeader $line "ls $remoteDataDir" >>$logFile 2>&1)
    dataDirIsExist=$?
    [ $dataDirIsExist -ne 0 ] && \
    log_warn_noDate  $line "`printf "%s\t\t\t%s\t\t\t%s\n" 数据目录  \"EXIST\" \"NOT EXIST\"`" || \
    log_info_noDate "`printf "%s\t\t\t%s\t\t\t%s\n" 数据目录  \"EXIST\" \"EXIST\"`"
    for i in $systemFstabMount;do if [ "$i" == "$remoteDataDir" ];then dataDirCheck=1;fi;done
    [[ $dataDirCheck -eq 1 ]] && \
    log_info_noDate "`printf "%s\t\t\t%s\t\t\t%s\n" 数据目录挂载  \"已挂载\" \"已挂载\"`" || \
    log_warn_noDate  $line "`printf "%s\t\t\t%s\t\t\t%s\n" 数据目录挂载  \"已挂载\" \"未挂载\"`"
    systemToolsYum=$($sshHeader $line "${sudoCmd} yum install net-tools rsync telnet unzip vim nc chrony fontconfig -y" >>$logFile 2>&1)
    [[ $? -ne 0 ]] && \
    log_warn_noDate  $line "`printf "%s\t\t\t%s\t\t\t%s\n" YUM检测  \"可用\" \"不可用\"`" || \
    log_info_noDate "`printf "%s\t\t\t%s\t\t\t%s\n" YUM检测  \"可用\" \"可用\"`"
  
    systemToolsNtp=$($sshHeader $line "${sudoCmd} ntpdc -np|grep '^\*'|wc -l" 2>>$logFile)
    systemToolsChrony=$($sshHeader $line "${sudoCmd} chronyc sources|grep '^\^\*'|wc -l" 2>>$logFile )
    [[ $systemToolsNtp -eq 0 ]] && [[ $systemToolsChrony -eq 0 ]] && \
    log_warn_noDate  $line "`printf "%s\t\t\t%s\t\t\t%s\n" 时间服务检测 \"正常\" \"异常\"`" || \
    log_info_noDate "`printf "%s\t\t\t%s\t\t\t%s\n" 时间服务检测 \"正常\" \"正常\"`"
    
  
  
    #内核参数
    sysctlVmSwappiness=$($sshHeader $line "${sudoCmd} cat /proc/sys/vm/swappiness" 2>>$logFile)
    [ $sysctlVmSwappiness -gt 10 ] && \
    log_warn_noDate  $line "`printf "%s\t\t%s\t\t\t%s\n" 内核:swappiness  \"<=10\" \"$sysctlVmSwappiness\"`" || \
    log_info_noDate "`printf "%s\t\t%s\t\t\t%s\n" 内核:swappiness  \"<=10\" \"$sysctlVmSwappiness\"`" 
    sysctlVmMaxmapcount=$($sshHeader $line "${sudoCmd} cat /proc/sys/vm/max_map_count" 2>>$logFile)
    [ $sysctlVmMaxmapcount -lt 6553500 ] && \
    log_warn_noDate  $line "`printf "%s\t\t%s\t\t%s\n" 内核:max_map_count  \">=6553500\" \"$sysctlVmMaxmapcount\"`" || \
    log_info_noDate "`printf "%s\t\t%s\t\t%s\n" 内核:max_map_count  \">=6553500\" \"$sysctlVmMaxmapcount\"`" 
    sysctlFsFilemax=$($sshHeader $line "${sudoCmd} cat /proc/sys/fs/file-max" 2>>$logFile)
    [ $sysctlFsFilemax -lt 100000000 ] && \
    log_warn_noDate  $line "`printf "%s\t\t\t%s\t\t%s\n" 内核:file\-max \">=100000000\" \"$sysctlFsFilemax\"`" || \
    log_info_noDate "`printf "%s\t\t\t%s\t\t%s\n" 内核:file\-max \">=100000000\" \"$sysctlFsFilemax\"`" 
    sysctlFsNropen=$($sshHeader $line "${sudoCmd} cat /proc/sys/fs/nr_open" 2>>$logFile)
    [ $sysctlFsNropen -lt 10240000 ] && \
    log_warn_noDate  $line "`printf "%s\t\t\t%s\t\t%s\n" 内核:nr_open \">=10240000\" \"$sysctlFsNropen\"`" || \
    log_info_noDate "`printf "%s\t\t\t%s\t\t%s\n" 内核:nr_open \">=10240000\" \"$sysctlFsNropen\"`" 
    sysctlNetCoreSomaxconn=$($sshHeader $line "${sudoCmd} cat /proc/sys/net/core/somaxconn" 2>>$logFile)
    [ $sysctlNetCoreSomaxconn -lt 1024 ] && \
    log_warn_noDate  $line "`printf "%s\t\t%s\t\t\t%s\n" 内核:somaxconn  \">=1024\" \"$sysctlNetCoreSomaxconn\"`" || \
    log_info_noDate "`printf "%s\t\t%s\t\t\t%s\n" 内核:somaxconn  \">=1024\" \"$sysctlNetCoreSomaxconn\"`" 
    sysctlNetIpv4Ipforward=$($sshHeader $line "${sudoCmd} cat /proc/sys/net/ipv4/ip_forward" 2>>$logFile)
    [ $sysctlNetIpv4Ipforward -ne 1 ] && \
    log_warn_noDate  $line "`printf "%s\t\t%s\t\t\t%s\n" 内核:ip_forward  \"==1\" \"$sysctlNetIpv4Ipforward\"`" || \
    log_info_noDate "`printf "%s\t\t%s\t\t\t%s\n" 内核:ip_forward  \"==1\" \"$sysctlNetIpv4Ipforward\"`" 
    #sysctlVmOvercommit_memory=$($sshHeader $line "${sudoCmd} cat /proc/sys/vm/overcommit_memory" 2>>$logFile)
    #[ $sysctlVmOvercommit_memory -ne 1 ] && \
    #log_warn_noDate  $line "`printf "%s\t%s\t\t\t%s\n" 内核:Overcommit_memory  \"==1\" \"$sysctlVmOvercommit_memory\"`" || \
    #log_info_noDate "`printf "%s\t%s\t\t\t%s\n" 内核:Overcommit_memory  \"==1\" \"$sysctlVmOvercommit_memory\"`" 
  
    #limits
    ## nofile
    systemLimits=$($sshHeader $line "${sudoCmd} cat /etc/security/limits.conf /etc/security/limits.d/*.conf|grep -v '^#'|grep -v '^$'" 2>>$logFile)
    nofileAllGlobal=$(echo "$systemLimits"|grep -E "[[:space:]]*\*[[:space:]]+-[[:space:]]+nofile[[:space:]]+[[:digit:]]+"|head -n 1|awk '{print $NF}')
    nofileSoftGlobal=$(echo "$systemLimits"|grep -E "[[:space:]]*\*[[:space:]]+soft[[:space:]]+nofile[[:space:]]+[[:digit:]]+"|head -n 1|awk '{print $NF}')
    nofileHardGlobal=$(echo "$systemLimits"|grep -E "[[:space:]]*\*[[:space:]]+hard[[:space:]]+nofile[[:space:]]+[[:digit:]]+"|head -n 1|awk '{print $NF}')
    if [ -n "$nofileAllGlobal" ];then 
      nofileGlobal=$nofileAllGlobal
    elif [ -n "$nofileHardGlobal" ] ;then
      nofileGlobal=$nofileHardGlobal
    elif [ -n "$nofileSoftGlobal" ] ;then
      nofileGlobal=$nofileSoftGlobal
    else
      nofileGlobal=1024
    fi  
    nofileAllUser=$(echo "$systemLimits"|grep -E "[[:space:]]*${remoteAppUser}[[:space:]]+-[[:space:]]+nofile[[:space:]]+[[:digit:]]+"|head -n 1|awk '{print $NF}')
    nofileSoftUser=$(echo "$systemLimits"|grep -E "[[:space:]]*${remoteAppUser}[[:space:]]+soft[[:space:]]+nofile[[:space:]]+[[:digit:]]+"|head -n 1|awk '{print $NF}')
    nofileHardUser=$(echo "$systemLimits"|grep -E "[[:space:]]*${remoteAppUser}[[:space:]]+hard[[:space:]]+nofile[[:space:]]+[[:digit:]]+"|head -n 1|awk '{print $NF}')
    if [ -n "$nofileAllUser" ];then 
      nofileUser=$nofileAllUser
    elif [ -n "$nofileHardUser" ] ;then
      nofileUser=$nofileHardUser
    elif [ -n "$nofileSoftUser" ] ;then
      nofileUser=$nofileSoftUser
    else
      nofileUser=$nofileGlobal
    fi  
    [ $nofileUser -lt 100000 -o $nofileUser -gt $sysctlFsNropen ] && \
    log_warn_noDate  $line "`printf "%s\t\t\t%s\t\t%s\n" limits:nofile \">=100000\" \"$nofileUser\"`" || \
    log_info_noDate "`printf "%s\t\t\t%s\t\t%s\n" limits:nofile \">=100000\" \"$nofileUser\"`" 

    ###memlock
    #memlockAllGlobal=$(echo "$systemLimits"|grep -E "[[:space:]]*\*[[:space:]]+-[[:space:]]+memlock[[:space:]]+.+"|head -n 1|awk '{print $NF}')
    #memlockSoftGlobal=$(echo "$systemLimits"|grep -E "[[:space:]]*\*[[:space:]]+soft[[:space:]]+memlock[[:space:]]+.+"|head -n 1|awk '{print $NF}')
    #memlockHardGlobal=$(echo "$systemLimits"|grep -E "[[:space:]]*\*[[:space:]]+hard[[:space:]]+memlock[[:space:]]+.+"|head -n 1|awk '{print $NF}')
    #if [ -n "$memlockAllGlobal" ];then 
    #  memlockGlobal=$memlockAllGlobal
    #elif [ -n "$memlockHardGlobal" ] ;then
    #  memlockGlobal=$memlockHardGlobal
    #elif [ -n "$memlockSoftGlobal" ] ;then
    #  memlockGlobal=$memlockSoftGlobal
    #else
    #  memlockGlobal=64
    #fi  
    #memlockAllUser=$(echo "$systemLimits"|grep -E "[[:space:]]*${remoteAppUser}[[:space:]]+-[[:space:]]+memlock[[:space:]]+.+"|head -n 1|awk '{print $NF}')
    #memlockSoftUser=$(echo "$systemLimits"|grep -E "[[:space:]]*${remoteAppUser}[[:space:]]+soft[[:space:]]+memlock[[:space:]]+.+"|head -n 1|awk '{print $NF}')
    #memlockHardUser=$(echo "$systemLimits"|grep -E "[[:space:]]*${remoteAppUser}[[:space:]]+hard[[:space:]]+memlock[[:space:]]+.+"|head -n 1|awk '{print $NF}')
    #if [ -n "$memlockAllUser" ];then 
    #  memlockUser=$memlockAllUser
    #elif [ -n "$memlockHardUser" ] ;then
    #  memlockUser=$memlockHardUser
    #elif [ -n "$memlockSoftUser" ] ;then
    #  memlockUser=$memlockSoftUser
    #else
    #  memlockUser=$memlockGlobal
    #fi  
    #[ "$memlockUser" != "unlimited" ] && \
    #log_warn_noDate  $line "`printf "%s\t\t%s\t\t%s\n" limits:memlock \"==unlimited\" \"$memlockUser\"`" || \
    #log_info_noDate "`printf "%s\t\t%s\t\t%s\n" limits:memlock \"==unlimited\" \"$memlockUser\"`" 
  
    ##noproc
    nprocAllGlobal=$(echo "$systemLimits"|grep -E "[[:space:]]*\*[[:space:]]+-[[:space:]]+nproc[[:space:]]+[[:digit:]]+"|head -n 1|awk '{print $NF}')
    nprocSoftGlobal=$(echo "$systemLimits"|grep -E "[[:space:]]*\*[[:space:]]+soft[[:space:]]+nproc[[:space:]]+[[:digit:]]+"|head -n 1|awk '{print $NF}')
    nprocHardGlobal=$(echo "$systemLimits"|grep -E "[[:space:]]*\*[[:space:]]+hard[[:space:]]+nproc[[:space:]]+[[:digit:]]+"|head -n 1|awk '{print $NF}')
    if [ -n "$nprocAllGlobal" ];then 
      nprocGlobal=$nprocAllGlobal
    elif [ -n "$nprocHardGlobal" ] ;then
      nprocGlobal=$nprocHardGlobal
    elif [ -n "$nprocSoftGlobal" ] ;then
      nprocGlobal=$nprocSoftGlobal
    else
      nprocGlobal=4096
    fi  
    nprocAllUser=$(echo "$systemLimits"|grep -E "[[:space:]]*${remoteAppUser}[[:space:]]+-[[:space:]]+nproc[[:space:]]+[[:digit:]]+"|head -n 1|awk '{print $NF}')
    nprocSoftUser=$(echo "$systemLimits"|grep -E "[[:space:]]*${remoteAppUser}[[:space:]]+soft[[:space:]]+nproc[[:space:]]+[[:digit:]]+"|head -n 1|awk '{print $NF}')
    nprocHardUser=$(echo "$systemLimits"|grep -E "[[:space:]]*${remoteAppUser}[[:space:]]+hard[[:space:]]+nproc[[:space:]]+[[:digit:]]+"|head -n 1|awk '{print $NF}')
    if [ -n "$nprocAllUser" ];then 
      nprocUser=$nprocAllUser
    elif [ -n "$nprocHardUser" ] ;then
      nprocUser=$nprocHardUser
    elif [ -n "$nprocSoftUser" ] ;then
      nprocUser=$nprocSoftUser
    else
      nprocUser=$nprocGlobal
    fi  
    [ $nprocUser -lt 65535 ] && \
    log_warn_noDate  $line "`printf "%s\t\t\t%s\t\t\t%s\n" limits:nproc \">=65535\" \"$nprocUser\"`" || \
    log_info_noDate "`printf "%s\t\t\t%s\t\t\t%s\n" limits:nproc \">=65535\" \"$nprocUser\"`" 
  
    #网络
    networkNicMTU=$($sshHeader $line "${sudoCmd} ifconfig|grep mtu|grep -v '^lo:'|grep 'RUNNING' " 2>>$logFile)
    networkNicMTU=$(echo $networkNicMTU|sed -e "s/.*mtu[[:blank:]]*\([[:digit:]]*\).*/\1/")
    [ $networkNicMTU -ne 1500 ] && \
    log_warn_noDate  $line "`printf "%s\t\t\t%s\t\t\t%s\n" 网络:NicMTU \"1500\" \"$networkNicMTU\"`" || \
    log_info_noDate "`printf "%s\t\t\t%s\t\t\t%s\n" 网络:NicMTU \"1500\" \"$networkNicMTU\"`" 
  
  
    #安全
    safeFirewall=$($sshHeader $line "${sudoCmd} firewall-cmd --state" >>$logFile 2>&1)
    [ $? -eq 0 ] && \
    log_warn_noDate  $line "`printf "%s\t\t\t%s\t\t\t%s\n" 安全:Firewall  \"STOP\" \"RUNNING\"`" || \
    log_info_noDate "`printf "%s\t\t\t%s\t\t\t%s\n" 安全:Firewall  \"STOP\" \"STOP\"`" 
    safeSelinux=$($sshHeader $line "${sudoCmd} getenforce" 2>>$logFile)
    [[ "$safeSelinux" = "Enforcing"  ]] && \
    log_warn_noDate  $line "`printf "%s\t\t\t%s\t\t%s\n" 安全:Selinux  \"Disabled\" \"$safeSelinux\"`" || \
    log_info_noDate "`printf "%s\t\t\t%s\t\t%s\n" 安全:Selinux  \"Disabled\" \"$safeSelinux\"`" 
    echo ""
  done<$ipListFile

  hostCount=`cat $ipListFile|wc -l`
  [ $hostCount -eq 1 ] && exit 0
  log_info_noDate "\e[1;36m`printf "%s"       「节点间差异性检测报告」`\e[0m"
  log_info_noDate "`printf "%s\t\t\t\t%s\t\t%s\n" 检测项 预期值 当前值`"
  declare -a hostNameList
  while read line;do
    hostName="$($sshHeader $line 'hostname')"
    hostNameList+=($hostName)
  done < $ipListFile
  [  $(echo ${hostNameList[@]}|sed 's/ /\n/g'|sort|uniq|wc -l) -lt $hostCount ] && \
  log_warn_noDate   "all" "`printf "%s\t\t\t\t%s\t\t%s\n" 主机名比对  \"互异\" \"重复\"`" || \
  log_info_noDate "`printf "%s\t\t\t\t%s\t\t%s\n" 主机名比对  \"互异\" \"互异\"`"
  
  declare -a hostTimeZoneList
  while read line;do
    hostTimeZone="$($sshHeader $line "date -R|awk '{print \$NF}'")"
    hostTimeZoneList+=($hostTimeZone)
  done < $ipListFile
  [  $(echo ${hostTimeZoneList[@]}|sed 's/ /\n/g'|sort|uniq|wc -l) -ne 1 ] && \
  log_warn_noDate   "all" "`printf "%s\t\t\t%s\t\t%s\n" 主机间时区比对  \"一致\" \"差异\"`" || \
  log_info_noDate "`printf "%s\t\t\t%s\t\t%s\n" 主机间时区比对  \"一致\" \"一致\"`" 
  
  declare -a hostTimeList
  while read line;do
    hostTime=$($sshHeader $line "date '+%s' 2>/dev/null") 
    hostTimeList+=($hostTime)
  done < $ipListFile
  hostTimeDiffMaxValue=${hostTimeList[0]}
  hostTimeDiffMinValue=${hostTimeList[0]}
  for i in ${hostTimeList[@]};do 
    [ $hostTimeDiffMaxValue -lt $i ] && hostTimeDiffMaxValue=$i
    [ $hostTimeDiffMinValue -gt $i ] && hostTimeDiffMinValue=$i
  done
  hostTimeDiff=`expr $hostTimeDiffMaxValue - $hostTimeDiffMinValue`
  [  $hostTimeDiff -gt 5 ] && \
  log_warn_noDate   "all" "`printf "%s\t\t\t%s\t\t%s\n" 主机间时间差值  \"<=5s\" \"${hostTimeDiff}s\"`" || \
  log_info_noDate "`printf "%s\t\t\t%s\t\t%s\n" 主机间时间差值  \"<=5s\" \"${hostTimeDiff}s\"`"
}

function getSaveList {
  cmd=$(ls ${savePath}/checkResult.* >>$logFile 2>&1)
  if [ $? -ne 0 ];then
    echo 0
  else
  lens=1
  for i in `ls -t ${savePath}/checkResult.*`;do
    timeF=$(echo $i|awk -F '.' '{print $NF}')
    timeF=$(date --date="@${timeF}" "+%Y-%m-%d %H:%M:%S")
    [ -n "$saveList" ] && saveList="$saveList\n${lens}.${timeF} $i"
    [ -z "$saveList" ] && saveList="${lens}.${timeF} $i"
    lens=`expr $lens + 1`
  done
  fi
  echo -e "${saveList}"
}

function repairWork {
  rel=`getSaveList`
  [ "$rel" = "0" ] && log_crit "检测结果不存在，请先执行checklist！" && exit 1
  relFileName=$(echo -e "$rel"|grep "^1\."|awk '{print $3}')
  timeFlag=$(echo $relFileName|awk -F '.' '{print $NF}')
  log_info_noDate "本次修复条目："
  log_info_noDate "`printf "%s\t\t\t%s\n" 节点 检测项`"

  while read line;do 
    point=`echo $line|awk '{print $1}'`
    host=`echo $line|awk '{print $2}'` 
    [ "$host" != "all" ] && log_info_noDate "`printf "%s\t\t%s\n" $host $point `"
  done < $relFileName
  read -p "请确认是否执行(yes/no):" ans
  while true;do
    [ "$ans" = "yes" ] && break
    [ "$ans" = "no" ] && log_info_noDate "终止执行" && exit 0
    read -p "yes/no:" ans
  done
  init_remote
  cmd=$(cat $relFileName|grep "系统主机名")
  if [ "$?" = "0" ];then
    log_info_noDate "选择设置主机名方式,默认为1："
    log_info_noDate "1 固定前后缀方式"
    log_info_noDate "2 模版文件方式"
    read -p "`echo -e "\e[35m你的选择:\e[0m"`" hostnameMode
    [ -z "$hostnameMode" ] && hostnameMode=1
    while true;do
      [ "$hostnameMode" = "1" ] && break
      [ "$hostnameMode" = "2" ] && break
      read -p '1或2:' hostnameMode
    done
  fi
  if [ "$hostnameMode" = "1" ] ;then
    read -p "`echo -e "\e[35m输入主机名前缀[server]:\e[0m"`" beforefix
    read -p "`echo -e "\e[35m输入主机名后缀[.bigdata.local]:\e[0m"`" afterfix
    [ -z "$beforefix" ] && beforefix="server"
    [ -z "$afterfix" ] && afterfix=".bigdata.local"
  elif [ "$hostnameMode" = "2" ] ;then
    read -p "`echo -e "\e[35m包含主机名和IP对应关系的文件位置(./hosts.list)：\e[0m"`" hostFile
    [[ -z "$hostFile" ]] && hostFile="./hosts.list"
    if [[ -f $hostFile  ]] && [[ -r $hostFile ]] && [[ -s $hostFile ]];then
      continue
    else
      hostnameS=""
    fi
  fi
  while read line;do
    checkPoint=$(echo $line|awk '{print $1}')
    host=$(echo $line|awk '{print $2}')
    case $checkPoint in
      "系统主机名")
      if [ "$hostnameMode" = "1" ];then 
        hostnameS="$beforefix`echo $host|awk -F '.' '{print $NF}'`$afterfix"
      elif [ "$hostnameMode" = "2" ];then
        hostnameS=""
        if [[ -f $hostFile  ]] && [[ -r $hostFile ]] && [[ -s $hostFile ]];then
          hostnameS=$(cat $hostFile|grep $host|awk -F "$host" '{print $NF}')
          [ -z "$hostnameS" ] && hostnameS=$(cat $hostFile|grep $host|awk -F "$host" '{print $1}')
        fi
      fi
      if [ -n "$hostnameS" ];then
        setHost=$($sshHeader $host "${sudoCmd} hostnamectl set-hostname $hostnameS --static" >>$logFile 2>&1)
        [ $? -eq 0 ] && \
        log_info_noDate "`printf "%s\t%s\t\t%s\n" [成功] $host $checkPoint`" ||\
        log_crit_noDate "`printf "%s\t%s\t\t%s\n" [失败] $host $checkPoint`"
      else
        log_crit_noDate "`printf "%s\t%s\t\t%s\n" [失败] $host $checkPoint`"
      fi
      ;;
      "系统时区")
      systemTimeZone=$($sshHeader $host "ls /usr/share/zoneinfo/Asia/Shanghai" >>$logFile 2>&1)
      [ $? -eq 0 ] && \
      systemTimeZone=$($sshHeader $host "${sudoCmd} ln -snf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime" >>$logFile 2>&1)
      [ $? -eq 0 ] && \
      log_info_noDate "`printf "%s\t%s\t\t%s\n" [成功] $host $checkPoint`" ||\
      log_crit_noDate "`printf "%s\t%s\t\t%s\n" [失败] $host $checkPoint`"
      ;;
      "系统HugePageDefrag")
      systemHugepageDefrag=$($sshHeader $host "${sudoCmd} chmod a+x /etc/rc.d/rc.local" >>$logFile 2>&1)
      [ $? -eq 0 ] && \
      systemHugepageDefrag=$($sshHeader $host "echo 'echo never > /sys/kernel/mm/transparent_hugepage/defrag'|${sudoCmd} tee -a /etc/rc.d/rc.local")
      systemHugepageDefrag=$($sshHeader $host "echo 'never'|${sudoCmd} tee /sys/kernel/mm/transparent_hugepage/defrag")
      [ $? -eq 0 ] && \
      log_info_noDate "`printf "%s\t%s\t\t%s\n" [成功] $host $checkPoint`" ||\
      log_crit_noDate "`printf "%s\t%s\t\t%s\n" [失败] $host $checkPoint`"
      ;;
      "系统HugePageEnabled")
      systemHugepageEnabled=$($sshHeader $host "${sudoCmd} chmod a+x /etc/rc.d/rc.local" >>$logFile 2>&1)
      [ $? -eq 0 ] && \
      systemHugepageEnabled=$($sshHeader $host "echo 'echo never > /sys/kernel/mm/transparent_hugepage/enabled'|${sudoCmd} tee -a /etc/rc.d/rc.local")
      systemHugepageEnabled=$($sshHeader $host "echo 'never'|${sudoCmd} tee /sys/kernel/mm/transparent_hugepage/enabled")
      [ $? -eq 0 ] && \
      log_info_noDate "`printf "%s\t%s\t\t%s\n" [成功] $host $checkPoint`" ||\
      log_crit_noDate "`printf "%s\t%s\t\t%s\n" [失败] $host $checkPoint`"
      ;;
      "内核:swappiness")
        repair_sysctl vm.swappiness 0
      ;;
      "内核:max_map_count")
        repair_sysctl vm.max_map_count 6553500
      ;;
      "内核:file-max")
        repair_sysctl fs.file-max 100000000
      ;;
      "内核:nr_open")
        repair_sysctl fs.nr_open 10240000
      ;;
      "内核:somaxconn")
        repair_sysctl net.core.somaxconn 1024
      ;;
      "内核:ip_forward")
        repair_sysctl net.ipv4.ip_forward 1
      ;;
      #"内核:Overcommit_memory")
      #  repair_sysctl vm.overcommit_memory 1
      #;;
      "limits:nofile")
      sysctls=$($sshHeader $host "echo -e '*          -    nofile     100000'|${sudoCmd} tee -a /etc/security/limits.d/${remoteAppUser}.conf" >>$logFile 2>&1)
      [ $? -eq 0 ] && \
      log_info_noDate "`printf "%s\t%s\t\t%s\n" [成功] $host $checkPoint`" ||\
      log_crit_noDate "`printf "%s\t%s\t\t%s\n" [失败] $host $checkPoint`"
      ;;
      #"limits:memlock")
      #sysctls=$($sshHeader $host "echo -e '*          -    memlock     unlimited'|${sudoCmd} tee -a /etc/security/limits.d/${remoteAppUser}.conf" >>$logFile 2>&1)
      #[ $? -eq 0 ] && \
      #log_info_noDate "`printf "%s\t%s\t\t%s\n" [成功] $host $checkPoint`" ||\
      #log_crit_noDate "`printf "%s\t%s\t\t%s\n" [失败] $host $checkPoint`"
      #;;
      "limits:nproc")
      sysctls=$($sshHeader $host "echo -e '*          -    nproc     65535'|$sudoCmd tee -a /etc/security/limits.d/${remoteAppUser}.conf" >>$logFile 2>&1)
      [ $? -eq 0 ] && \
      log_info_noDate "`printf "%s\t%s\t\t%s\n" [成功] $host $checkPoint`" ||\
      log_crit_noDate "`printf "%s\t%s\t\t%s\n" [失败] $host $checkPoint`"
      ;;
      "安全:Firewall")
      safeFirewall=$($sshHeader $host "${sudoCmd} systemctl disable firewalld && ${sudoCmd} systemctl stop firewalld" >>$logFile 2>&1)
      safeFirewall=$($sshHeader $host "${sudoCmd} firewall-cmd --state" >>$logFile 2>&1)
      [ $? -ne 0 ] && \
      log_info_noDate "`printf "%s\t%s\t\t%s\n" [成功] $host $checkPoint`" ||\
      log_crit_noDate "`printf "%s\t%s\t\t%s\n" [失败] $host $checkPoint`"
      ;;
      "安全:Selinux")
      safeSelinux=$($sshHeader $host "${sudoCmd} sed -i '/^SELINUX=/c SELINUX=disabled' /etc/selinux/config" >>$logFile 2>&1)
      safeSelinux=$($sshHeader $host "${sudoCmd} setenforce 0" >>$logFile 2>&1)
      safeSelinux=$($sshHeader $host "${sudoCmd} getenforce" 2>>$logFile)
      [ "$safeSelinux" != "Enforcing" ] && \
      log_info_noDate "`printf "%s\t%s\t\t%s\n" [成功] $host $checkPoint`" ||\
      log_crit_noDate "`printf "%s\t%s\t\t%s\n" [失败] $host $checkPoint`"
      ;;
      *)
      log_crit_noDate "`printf "%s\t%s\t\t%s\n" [失败] $host $checkPoint[工具无法修复，请手动修复]`"
      ;;
    esac
  done < $relFileName
  rm -f $relFileName
}

case "${1:-}" in
  desc)
    printDesc
    ;;
  checklist)
    init_remote
    checkList
    ;;
  repair)
    repairWork
    ;;
  getinfo)
    getInfo
    ;;
  *)
    printHelp
esac

