vpn connect/disconnect shell script

renuka · September 23, 2009, 1:26am

Hi

I am not so good in scripting..trying ot learn it...need guidance of the experts in shell scripting..
Let me explain the scenario first..
a server MX1 is connected to another server MX2[199.8.7.29] through vpn..every 5 minute a script runs to test vpn connectivity between the 2 servers.when the vpn goes down a mail is sent as notification from MX..here is the shell script i have written on MX1..

sleep 1
l=`nmap -P0 -p25 199.8.7.29`
echo $l > /var/log/vpncon.log && echo $l >> /var/log/monscrpt.log
grep -qi "open" /var/log/vpncon.log
j=`echo $?`
if [ $j -ne 0 ]; then
echo Partner VPN Failed >> /var/log/monscrpt.log && echo $l | mailx -s "Partner VPN Failed" 'aarti_sankhe@cactus.com'
fi

the scipt only sends an email when the vpn goes down..
my next task is when the vpn comes up i need to send a mail form this script hat the vpn is up now..
please suggest.
Thanks in advance..

chakrapani · September 23, 2009, 4:27am

Will this work ... assuming you are using bash 2.03 or higher
------------------------------------------------------------------------
if nmap -P0 -p25 199.8.7.29 | grep -qi open >/dev/null 2>&1;
echo "[ $(/bin/date) ]: Partner VPN Failed" >> /var/log/monscrpt.log
mailx -s "Partner VPN Failed" 'aarti_sankhe@cactus.com' < /dev/null
exit 1;
else
echo "[ $(/bin/date) ]: VPN status looks good " >> /var/log/monscrpt.log
fi
exit 0;
------------------------------------------------------------------------

You might need to check with syntax ... mostly it will work
One thing I hate is log files without any date/time on when the event was last checked ... So I added that.

renuka · September 23, 2009, 4:32am

hi chakrapani,

Thank you very much for the solution..the nmap command also logs the date and time along with the connectivity status in the log file...
I will test the script you wrote above...

chakrapani · September 23, 2009, 5:05am

#!/bin/bash
VPNLOG="/var/log/vpncon.log"
MONLOG="/var/log/monscrpt.log"
STATUSFILE=/var/log/VPNSTATUS

# email space seperated
EMAILTO="aarti_sankhe@cactus.com chakrapani@WHATEVER"

function laststatus {
if grep $1  $STATUSFILE
then
  exit 1
fi
  exit 0
}

nmap -P0 -p25 199.8.7.29 > $VPNLOG
cat $VPNLOG >> $MONLOG
if grep -qi "open" $VPNLOG;
then
   echo "Partner VPN OK " >> $MONLOG
  ( laststatus "DOWN" ) && mailx -s "Partner VPN UP again" $EMAILTO < $VPNLOG ||   echo "UP" > $STATUSFILE
else
   echo "Partner VPN Failed" >> $MONLOG
  ( laststatus "UP" ) && mailx -s "Partner VPN Failed" $EMAILTO < $VPNLOG || echo "DOWN" > $STATUSFILE
fi

This has status also so you can put this in cron to check every 5 mins and will email only if there is status change...
At least I would not like to be part of this email list ... will get very annoying after couple of days.

You have to cleanup a bit to accommodate on your system

renuka · September 24, 2009, 4:46am

chakrapani:

#!/bin/bash
VPNLOG="/var/log/vpncon.log"
MONLOG="/var/log/monscrpt.log"
STATUSFILE=/var/log/VPNSTATUS

# email space seperated
EMAILTO="aarti_sankhe@cactus.com chakrapani@WHATEVER"

function laststatus {
if grep $1 $STATUSFILE
then
exit 1
fi
exit 0
}

nmap -P0 -p25 199.8.7.29 > $VPNLOG
cat $VPNLOG >> $MONLOG
if grep -qi "open" $VPNLOG;
then
echo "Partner VPN OK " >> $MONLOG
( laststatus "DOWN" ) && mailx -s "Partner VPN UP again" $EMAILTO < $VPNLOG || echo "UP" > $STATUSFILE
else
echo "Partner VPN Failed" >> $MONLOG
( laststatus "UP" ) && mailx -s "Partner VPN Failed" $EMAILTO < $VPNLOG || echo "DOWN" > $STATUSFILE
fi

This has status also so you can put this in cron to check every 5 mins and will email only if there is status change...
At least I would not like to be part of this email list ... will get very annoying after couple of days.

You have to cleanup a bit to accommodate on your system

hi Chakrapani,

You wrote an entire script for me, thank you very much...I can simply run the script on my server and get things work as required..but i want to understand how the function is making the status of vpn store in the statusfile, would you please explain me the same?
Thanks.

chakrapani · September 24, 2009, 5:04am

ok One very important thing; even though the script looks complete it may not be ... you need to make sure that it runs on your system .. Shell scripts have a bad habit of behaving differently on every system ... So I prefer to write the script on system direclty.

My script explanation

First few lines are defn ...

The function called laststatus checks the last status of the VPN. The idea is script runs every 5 mins and will email only change of status not DOWN every five mins when down ; so the function gets a parameter say "UP" or "DOWN" when called and will return 1 or 0 based on what is there in the statusfile.

Example: function is called with DOWN
laststatus "DOWN" then it will grep the status file to see if it is was DOWN when it checked last time if the status was DOWN then it is suppose to tell main prg not to send email because there is no change .

In the main prg we check if VPN status is really down or not and make decisions.

Now since I saw that you had two logs called VPNLOG and MONLOG ... I add them. Only difference is VPNLOG is overwritten every 5 mins when script is called from cron. And MONLOG will be appended with status of this script also.

I guess you need to still fix the script to work on your system ... let forum know if this worked ..

renuka · September 24, 2009, 6:13am

chakrapani:

ok One very important thing; even though the script looks complete it may not be ... you need to make sure that it runs on your system .. Shell scripts have a bad habit of behaving differently on every system ... So I prefer to write the script on system direclty.

My script explanation

First few lines are defn ...

The function called laststatus checks the last status of the VPN. The idea is script runs every 5 mins and will email only change of status not DOWN every five mins when down ; so the function gets a parameter say "UP" or "DOWN" when called and will return 1 or 0 based on what is there in the statusfile.

Example: function is called with DOWN
laststatus "DOWN" then it will grep the status file to see if it is was DOWN when it checked last time if the status was DOWN then it is suppose to tell main prg not to send email because there is no change .

In the main prg we check if VPN status is really down or not and make decisions.

Now since I saw that you had two logs called VPNLOG and MONLOG ... I add them. Only difference is VPNLOG is overwritten every 5 mins when script is called from cron. And MONLOG will be appended with status of this script also.

I guess you need to still fix the script to work on your system ... let forum know if this worked ..

Hi chakrapani,

I executed the script you wrote in cron and named is as partner-vpn.sh. i did not disconnect the vpn..everytime i executed the script using ./partner-vpn or even if he script is executed by cron after every 5 minutes i get an email generated from the script "Partner VPN UP again, whereas the mail should be recieved only when the VPN is up after being down...

chakrapani · September 24, 2009, 6:41am

Change this line ( laststatus "DOWN" ) to ( laststatus "UP" ) and also in else part
from UP to DOWN ... I think should fix it ..

Looks like I have missed the logic.

Please make sure you understand the script which you run on your server ... Any copy paste from internet might cause problem.

renuka · September 24, 2009, 7:04am

Hi chakrapani,

I made the changes as suggested by you, yet i recieve mail "Partner VPN UP again" everytime the script is executed..

I made some changes in the script that i posted in my first post, this is as per my understanding:
Please let me know if the logis is correct or not

[

l=`nmap -P0 -p25 197.7.7.29`
echo $l > /var/log/vpncon.log && echo $l >> /var/log/monscrpt.log
grep -qi "open" /var/log/vpncon.log
j=`echo $?`
if [ $j -ne 0 ]; then
echo -n > /tmp/vpn_failed
echo Partner VPN Failed >> /var/log/monscrpt.log && echo $l | mailx -s "Partner VPN Failed" 'rashmi_pawar@monitor.com
rm /tmp/vpn_failed &> /dev/null && echo Partner VPN Up >> /var/log/monscrpt.log && echo $l | mailx -s "Partner VPN UP" 'aarti_sankhe@cactus.com'
fi

]

the lines in red are added now..

thanks..

chakrapani · September 24, 2009, 8:36am

Your logic looks ok to me ... does it give you required results ?

---------- Post updated at 06:22 AM ---------- Previous update was at 06:21 AM ----------

can you run the earlier script with set -x option

Just change first line to #!/bin/bash -x and paste the result ...

---------- Post updated at 06:33 AM ---------- Previous update was at 06:22 AM ----------

Now I checked the script with some dummy values. Should work.

#!/bin/bash
VPNLOG="/var/log/vpncon.log"
MONLOG="/var/log/monscrpt.log"
STATUSFILE=/var/log/VPNSTATUS

# email space seperated
EMAILTO="aarti_sankhe@cactus.com chakrapani@WHATEVER"

function laststatus {
if grep $1  $STATUSFILE
then
  exit 0
fi
  exit 1
}

nmap -P0 -p25 199.8.7.29 > $VPNLOG
cat $VPNLOG >> $MONLOG
if grep -qi "open" $VPNLOG;
then
   echo "Partner VPN OK " >> $MONLOG
  ( laststatus "UP" ) &&  ( echo "VPN UP" ) || ( mailx -s "Partner VPN UP" $EMAILTO < $VPNLOG; echo "UP" > $STATUSFILE )
else
   echo "Partner VPN Failed" >> $MONLOG
  ( laststatus "DOWN" ) &&  ( echo "VPN DOWN" ) || ( mailx -s "Partner VPN DOWN" $EMAILTO < $VPNLOG; echo "DOWN" > $STATUSFILE )
fi

Run the code directly on the shell couple of times with -x options and then check if it gives you requied results.

---------- Post updated at 07:36 AM ---------- Previous update was at 06:33 AM ----------

One problem with you logic ... You are creating file and then checking file every time ... I dont understand that part ... The flag you are setting will not work ..

renuka:

Hi chakrapani,

I made the changes as suggested by you, yet i recieve mail "Partner VPN UP again" everytime the script is executed..

I made some changes in the script that i posted in my first post, this is as per my understanding:
Please let me know if the logis is correct or not

[

l=`nmap -P0 -p25 197.7.7.29`
echo $l > /var/log/vpncon.log && echo $l >> /var/log/monscrpt.log
grep -qi "open" /var/log/vpncon.log
j=`echo $?`
if [ $j -ne 0 ]; then
echo -n > /tmp/vpn_failed
echo Partner VPN Failed >> /var/log/monscrpt.log && echo $l | mailx -s "Partner VPN Failed" 'rashmi_pawar@monitor.com
rm /tmp/vpn_failed &> /dev/null && echo Partner VPN Up >> /var/log/monscrpt.log && echo $l | mailx -s "Partner VPN UP" 'aarti_sankhe@cactus.com'
fi

]

the lines in red are added now..

thanks..

renuka · September 25, 2009, 12:29am

Hi chakrapani,

here is the output of the script, i added -x in the first line of the script .e.m #!/bin/bash

[root@mx1 sbin]# ./partner-vpn.sh
+ VPNLOG=/var/log/vpncon.log
+ MONLOG=/var/log/monscrpt.log
+ STATUSFILE=/var/log/VPNSTATUS
+ EMAILTO=rashmi_pawar@monitor.com
+ nmap -P0 -p25 197.7.7.29
+ cat /var/log/vpncon.log
+ grep -qi open /var/log/vpncon.log
+ echo 'Partner VPN OK '
+ laststatus UP
+ grep UP /var/log/VPNSTATUS
+ exit 1
+ echo UP

chakrapani · September 25, 2009, 3:06am

Is this the output of the last one ? version 3 may be

Because it looks ok to me ... Just try and do a simple test

$ echo "DOWN" > /var/log/VPNSTATUS

Now you should get a mail after 5 mins ... that is it up ... Dont make any changes and you should not get the UP mail ...

if possible change the command .. nmap -P0 -p25 197.7.7.29 in the script to get a DOWN result ... and check that again you should get DOWN mail once and then no mails ...

Hopefully this is sorted your problem..

renuka · September 28, 2009, 10:36pm

Hi Chakrapani,

Thanks for the help. I need to mention again how the script should run. I need to write a script wherein i should recieve a mail when the VPN is down and when the vpn comes up i should a notification mail that the vpn is back up..That means i need to recieve email only twice, first when the vpn goes down and second when the vpn comes up..cron will run this script every 5 minutes..if the vpn goes down for 20 minutes the email stating "Partner VPN down" should be recieved 4 times, and the script is working as expected when the vpn goes down.. once the vpn is up only one email should be received that the vpn is back up.
I tried running the script you wrote for me, it sends an email that the "VPN is up" every time the script is executed..So the script should be modified in such a way that i should recieve "VPN UP" mail only once when it is back up...
Thanks.