#!/bin/bash
#long_running_apache - detects apache process that started over 10 minutes ago
# Copyright Brian Brazil <bbrazil@netsoc.tcd.ie> 2005
# http://www.netsoc.tcd.ie/~bbrazil/code/brmon
# $Id: long_running_apache,v 1.2 2005/12/26 17:41:57 bbrazil Exp $
#
#    This program is free software; you can redistribute it and/or modify
#    it under the terms of the GNU General Public License as published by
#    the Free Software Foundation; version 2 of the License.
#
#    This program is distributed in the hope that it will be useful,
#    but WITHOUT ANY WARRANTY; without even the implied warranty of
#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#    GNU General Public License for more details.
#
#    You should have received a copy of the GNU General Public License
#    along with this program; if not, write to the Free Software
#    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA


#Comma seperated list of apache users
#APACHE_USERS=apache
APACHE_USERS=apache,apache2,apache3,www-data

#How long a process must be running (in seconds) for us to flag it
THRESHOLD=600
#Note that any process running for over a day will be flagged

#Filter to pass output through - set to 'cat' if you don't want to filter
#Default:
filter(){ cat; }
#Ignore RT processes
#filter(){ egrep -v '^      rt( +[^ ]+){7} /opt/csw/bin/perl mason_handler.fcgi$'; }

case "$OSTYPE" in
'solaris')
        GAWK=/opt/csw/bin/gawk
        ;;
'linux-gnu')
        GAWK=/usr/bin/gawk
        ;;
*)
        GAWK=gawk
        ;;
esac
PS=/bin/ps
PGREP=/usr/bin/pgrep


#Get PIDs of apache processes
PIDS=$($PGREP -u $APACHE_USERS | tr -d ' ' | tr $'\n' '|')
PIDS=${PIDS%|}

#Get children of apache which have been running for too long
BAD_PIDS=$($PS -e -o 'ppid stime pid s' | $GAWK \
'BEGIN{start=systime()}

$1 ~ /^('"$PIDS"')$/{
	if( $4 ~ /^Z$/){
		#do nothing
	}else if( $2 ~ /^[^0-9]/ ){	#Running for over a day
		print $3;
	}else{
		cmd="date +%s -d"$2;
		cmd|getline t;
		if(t + '$THRESHOLD' < start){	#Running for too long
			print $3;
		}
	}
}
' | tr -d ' ' |tr $'\n' '|')
BAD_PIDS=${BAD_PIDS%|}
[ -z "$BAD_PIDS" ] && exit

#Get the children of these now, exclude known-good processes
OUT=$($PS -e -o 'user pid ppid s pcpu pmem time stime args' | 
awk '$3 ~ /^('"$BAD_PIDS"')$/{print} $2 ~ /^('"$BAD_PIDS"')$/{print}' | filter | 
sort -g -k 2)


[ -z "$OUT" ] && exit

mail -s "$HOSTNAME: apache processes running for too long" root <<EOF

The following process spawned by apache have been running for too long.

    USER   PID  PPID S %CPU %MEM        TIME    STIME COMMAND
$OUT
EOF