# Linux自动化运维：脚本编写与工具链整合实践

## 一、基础脚本编写规范与技巧

### 1.1 Shell脚本安全与健壮性

```bash

#!/bin/bash

# 脚本头部标准化配置

set -euo pipefail # 严格模式：错误退出、未定义变量报错、管道错误检测

IFS=$'\n\t' # 设置内部字段分隔符，避免空格问题

# 基础函数库

log_info() {

echo "[$(date '+%Y-%m-%d %H:%M:%S')] INFO: $*" >&2

}

log_error() {

echo "[$(date '+%Y-%m-%d %H:%M:%S')] ERROR: $*" >&2

}

# 配置检查函数

check_requirements() {

local missing=()

# 检查必需命令

for cmd in awk sed grep curl jq; do

if ! command -v "$cmd" >/dev/null 2>&1; then

missing+=("$cmd")

fi

done

if [[ ${#missing[@]} -gt 0 ]]; then

log_error "缺少必需工具: ${missing[*]}"

return 1

fi

}

```

### 1.2 参数解析模板

```bash

#!/bin/bash

# 配置默认值

CONFIG_FILE="${CONFIG_FILE:-/etc/app/config.conf}"

LOG_LEVEL="${LOG_LEVEL:-info}"

DRY_RUN=false

# 使用getopt进行专业参数解析

parse_args() {

local opts

opts=$(getopt -o c:l:dh --long config:,log-level:,dry-run,help -n "$0" -- "$@")

eval set -- "$opts"

while true; do

case "$1" in

-c|--config)

CONFIG_FILE="$2"

shift 2

;;

-l|--log-level)

LOG_LEVEL="$2"

shift 2

;;

-d|--dry-run)

DRY_RUN=true

shift

;;

-h|--help)

show_usage

exit 0

;;

--)

shift

break

;;

esac

done

# 剩余参数处理

if [[ $# -gt 0 ]]; then

TARGETS=("$@")

fi

}

# 配置验证函数

validate_config() {

[[ -f "$CONFIG_FILE" ]] || {

log_error "配置文件不存在: $CONFIG_FILE"

return 1

}

# 检查配置文件语法

if ! bash -n "$CONFIG_FILE" 2>/dev/null; then

log_error "配置文件语法错误"

return 1

fi

}

```

## 二、自动化部署脚本实践

### 2.1 应用部署流水线

```bash

#!/bin/bash

# deploy.sh - 自动化部署脚本

# 加载环境配置

source ./env.sh

# 部署主函数

deploy_application() {

local version="$1"

local environment="${2:-staging}"

log_info "开始部署 $version 到 $environment 环境"

# 前置检查

check_deployment_prerequisites || return 1

# 拉取镜像

pull_docker_image "app:$version" || {

log_error "拉取镜像失败"

return 1

}

# 执行数据库迁移

run_migrations "$environment" || {

log_error "数据库迁移失败"

return 1

}

# 更新服务配置

update_service_config "$environment" "$version" || {

log_error "更新配置失败"

return 1

}

# 滚动更新服务

rollout_service "app-service" "app:$version" || {

log_error "服务更新失败"

rollback_deployment

return 1

}

# 健康检查

if verify_deployment "$environment"; then

log_info "部署成功完成"

send_notification "部署成功: $version -> $environment"

else

log_error "部署验证失败"

rollback_deployment

return 1

fi

}

# 健康检查实现

verify_deployment() {

local environment="$1"

local max_attempts=30

local attempt=1

while [[ $attempt -le $max_attempts ]]; do

log_info "健康检查尝试 $attempt/$max_attempts"

if curl -sf http://${environment}.example.com/health >/dev/null; then

# 检查业务指标

local response

response=$(curl -s http://${environment}.example.com/metrics)

if echo "$response" | grep -q '"status":"healthy"'; then

return 0

fi

sleep 5

((attempt++))

done

return 1

}

```

### 2.2 配置管理模板

```bash

#!/bin/bash

# config_manager.sh - 配置管理工具

# 使用envsubst进行配置模板化

generate_config() {

local template_file="$1"

local output_file="$2"

local env_file="${3:-.env}"

# 加载环境变量

if [[ -f "$env_file" ]]; then

set -a

source "$env_file"

set +a

fi

# 生成最终配置

envsubst < "$template_file" > "$output_file"

# 验证生成的配置

validate_generated_config "$output_file"

}

# 配置模板示例：nginx.conf.template

: <<'NGINX_TEMPLATE'

server {

listen ${NGINX_PORT:-80};

server_name ${SERVER_NAME};

location / {

proxy_pass http://${APP_HOST}:${APP_PORT};

proxy_set_header Host $host;

}

# 错误页面

error_page 500 502 503 504 /50x.html;

}

NGINX_TEMPLATE

```

## 三、监控与告警自动化

### 3.1 系统监控脚本

```bash

#!/bin/bash

# system_monitor.sh - 系统资源监控

# 监控配置

MONITOR_INTERVAL=60

ALERT_THRESHOLD_CPU=90

ALERT_THRESHOLD_MEM=85

ALERT_THRESHOLD_DISK=90

# 监控主循环

monitor_system() {

while true; do

local timestamp

timestamp=$(date -Iseconds)

# 收集指标

local cpu_usage memory_usage disk_usage

cpu_usage=$(get_cpu_usage)

memory_usage=$(get_memory_usage)

disk_usage=$(get_disk_usage "/")

# 记录日志

echo "$timestamp CPU:$cpu_usage% MEM:$memory_usage% DISK:$disk_usage%" \

>> /var/log/system_metrics.log

# 检查阈值

check_thresholds "$cpu_usage" "$memory_usage" "$disk_usage"

# 生成报告（每分钟）

if [[ $(date +%M) == "00" ]]; then

generate_hourly_report

fi

sleep "$MONITOR_INTERVAL"

done

}

# 指标收集函数

get_cpu_usage() {

# 使用/proc/stat计算CPU使用率

local cpu_line

cpu_line=$(grep '^cpu ' /proc/stat)

local -a cpu_values

read -r _ cpu_values <<< "$cpu_line"

local total idle

total=0

for value in "${cpu_values[@]}"; do

((total += value))

done

idle=${cpu_values[3]}

echo $((100 - (idle * 100) / total))

}

# 阈值检查与告警

check_thresholds() {

local cpu=$1 mem=$2 disk=$3

[[ $cpu -gt $ALERT_THRESHOLD_CPU ]] && \

send_alert "high_cpu" "CPU使用率过高: ${cpu}%"

[[ $mem -gt $ALERT_THRESHOLD_MEM ]] && \

send_alert "high_memory" "内存使用率过高: ${mem}%"

[[ $disk -gt $ALERT_THRESHOLD_DISK ]] && \

send_alert "high_disk" "磁盘使用率过高: ${disk}%"

}

# 告警发送函数

send_alert() {

local alert_type="$1"

local message="$2"

# 发送到多种渠道

send_slack_alert "$alert_type" "$message"

send_email_alert "$alert_type" "$message"

# 记录到日志

log_error "告警: $message"

}

```

### 3.2 日志分析与处理

```bash

#!/bin/bash

# log_analyzer.sh - 日志分析工具

analyze_access_logs() {

local log_file="${1:-/var/log/nginx/access.log}"

local report_file="/tmp/access_report_$(date +%Y%m%d).txt"

# 生成分析报告

{

echo "=== 访问日志分析报告 ==="

echo "生成时间: $(date)"

echo "日志文件: $log_file"

echo

# 统计总请求数

local total_requests

total_requests=$(wc -l < "$log_file")

echo "总请求数: $total_requests"

# 状态码分布

echo "状态码分布:"

awk '{print $9}' "$log_file" | sort | uniq -c | sort -rn

# 最频繁的访问IP

echo -e "\n最频繁访问IP:"

awk '{print $1}' "$log_file" | sort | uniq -c | sort -rn | head -10

# 最慢的请求

echo -e "\n最慢的请求(前10):"

awk '{print $7, $NF}' "$log_file" | sort -k2 -rn | head -10

# 错误请求分析

echo -e "\n错误请求(4xx/5xx):"

awk '$9 >= 400 {print $9, $7, $1}' "$log_file" | \

sort | uniq -c | sort -rn | head -20

<"flmnsvsqexff.csxthr.com"><"kltyzx.zhaiLimao.com"><"baby.yunruiwater.cn">

} > "$report_file"

# 发送报告

send_report_via_email "$report_file"

}

# 实时日志监控

tail_logs() {

local log_file="$1"

local patterns=("ERROR" "WARN" "Exception" "500")

tail -f "$log_file" | while read -r line; do

for pattern in "${patterns[@]}"; do

if echo "$line" | grep -q "$pattern"; then

echo "[$(date '+%H:%M:%S')] 匹配模式 '$pattern': $line"

# 触发相应处理

handle_log_pattern "$pattern" "$line"

break

fi

done

}

```

## 四、容器化环境自动化

### 4.1 Docker容器管理脚本

```bash

#!/bin/bash

# docker_manager.sh - 容器运维工具

# 批量容器操作

manage_containers() {

local action="$1"

local filter="${2:-}"

# 获取容器列表

local containers

containers=$(docker ps --filter "$filter" --format "{{.Names}}")

case "$action" in

restart)

echo "重启容器:"

for container in $containers; do

echo " 重启 $container"

docker restart "$container" && \

wait_for_healthy "$container"

done

;;

update)

echo "更新容器:"

for container in $containers; do

update_single_container "$container"

done

;;

cleanup)

echo "清理停止的容器:"

docker container prune -f

echo "清理未使用的镜像:"

docker image prune -f

;;

esac

}

# 容器健康检查

wait_for_healthy() {

local container="$1"

local max_wait=180

local wait_time=0

echo "等待容器 $container 健康..."

while [[ $wait_time -lt $max_wait ]]; do

if docker inspect --format='{{.State.Health.Status}}' "$container" 2>/dev/null | \

grep -q "healthy"; then

echo "容器 $container 已健康"

return 0

fi

sleep 5

((wait_time += 5))

done

echo "警告: 容器 $container 健康检查超时"

return 1

}

# 镜像管理函数

manage_images() {

local action="$1"

local repository="${2:-}"

case "$action" in

cleanup)

# 清理旧镜像，保留最近的5个

docker images "$repository" --format "{{.Tag}}" | \

sort -V | head -n -5 | while read -r tag; do

docker rmi "$repository:$tag"

done

;;

sync)

# 同步镜像到多个仓库

local source="$3"

local destinations=("${@:4}")

for dest in "${destinations[@]}"; do

echo "同步镜像到 $dest"

docker pull "$source"

docker tag "$source" "$dest"

docker push "$dest"

done

;;

esac

}

```

## 五、基础设施即代码实践

### 5.1 Terraform与脚本整合

```bash

#!/bin/bash

# infrastructure.sh - 基础设施管理

# 环境初始化

init_infrastructure() {

local environment="$1"

# 创建terraform工作区

terraform workspace new "$environment" 2>/dev/null || \

terraform workspace select "$environment"

# 初始化terraform

terraform init -backend-config="env/$environment/backend.conf"

# 验证配置

terraform validate

}

# 计划与应用变更

plan_and_apply() {

local environment="$1"

local auto_approve="${2:-false}"

init_infrastructure "$environment"

# 生成执行计划

local plan_file="/tmp/terraform_plan_${environment}_$(date +%s).tfplan"

terraform plan -out="$plan_file" -var-file="env/$environment/variables.tfvars"

if [[ "$auto_approve" == "true" ]]; then

terraform apply "$plan_file"

else

# 人工审核模式

echo "执行计划已保存到: $plan_file"

read -rp "是否应用此计划? (yes/no): " confirm

if [[ "$confirm" == "yes" ]]; then

terraform apply "$plan_file"

else

echo "已取消应用"

fi

}

# 基础设施健康检查

check_infrastructure() {

local environment="$1"

# 检查云资源状态

check_aws_resources "$environment"

check_database_connections "$environment"

check_load_balancer_health "$environment"

# 生成报告

generate_infrastructure_report "$environment"

}

```

### 5.2 配置漂移检测

```bash

#!/bin/bash

# config_drift.sh - 配置漂移检测

detect_config_drift() {

local baseline_dir="/etc/config/baseline"

local current_dir="/etc/config/current"

local report_file="/var/log/config_drift_$(date +%Y%m%d).log"

# 创建当前配置快照

create_config_snapshot "$current_dir"

# 比较差异

{

echo "配置漂移检测报告 - $(date)"

echo "============================="

# 检查文件差异

diff -rq "$baseline_dir" "$current_dir" | while read -r line; do

echo "$line"

# 提取文件名并详细比较

if [[ "$line" =~ ^Files\ (.*)\ and\ (.*)\ differ$ ]]; then

local file1="${BASH_REMATCH[1]}"

local file2="${BASH_REMATCH[2]}"

echo "详细差异:"

diff -u "$file1" "$file2" | head -20

echo

fi

done

# 统计信息

echo -e "\n统计信息:"

echo "基线文件数: $(find "$baseline_dir" -type f | wc -l)"

echo "当前文件数: $(find "$current_dir" -type f | wc -l)"

echo "差异文件数: $(diff -rq "$baseline_dir" "$current_dir" | grep -c "^Files")"

} > "$report_file"

# 如果有差异，发送告警

if grep -q "differ" "$report_file"; then

send_config_drift_alert "$report_file"

fi

}

```

## 六、CI/CD流水线集成

### 6.1 Git钩子与自动化测试

```bash

#!/bin/bash

# pre-commit - Git预提交钩子

# 运行静态代码分析

run_linters() {

echo "运行代码检查..."

# Shell脚本检查

find . -name "*.sh" -exec shellcheck {} +

# Python检查

if command -v pylint >/dev/null; then

find . -name "*.py" -exec pylint {} +

fi

# YAML检查

find . -name "*.yaml" -name "*.yml" -exec yamllint {} +

<"inch.sxyicheng.cn"><"wall.jsnjz.cn"><"xyz.csxthr.com">

}

# 运行单元测试

run_unit_tests() {

echo "运行单元测试..."

# 根据项目类型选择测试框架

if [[ -f "pytest.ini" ]]; then

python -m pytest tests/unit/

elif [[ -f "package.json" ]]; then

npm test

elif [[ -f "go.mod" ]]; then

go test ./...

fi

}

# 安全扫描

security_scan() {

echo "运行安全扫描..."

# 检查依赖漏洞

if [[ -f "requirements.txt" ]]; then

pip-audit -r requirements.txt

fi

# 检查敏感信息

detect_secrets --scan .

}

```

### 6.2 构建与发布自动化

```bash

#!/bin/bash

# build_pipeline.sh - 构建流水线

main() {

local branch="${1:-main}"

local version="${2:-$(date +%Y%m%d_%H%M%S)}"

# 设置环境

export BUILD_VERSION="$version"

# 阶段1: 准备

prepare_build_environment || return 1

# 阶段2: 构建

run_build "$branch" || {

log_error "构建失败"

return 1

}

# 阶段3: 测试

run_test_suite || {

log_error "测试失败"

return 1

}

# 阶段4: 打包

create_artifacts || {

log_error "打包失败"

return 1

}

# 阶段5: 发布

if [[ "$branch" == "main" ]]; then

publish_release "$version"

fi

log_info "流水线执行完成"

}

# 构建函数

run_build() {

local branch="$1"

# 多语言构建支持

if [[ -f "Dockerfile" ]]; then

docker build -t "app:$BUILD_VERSION" .

elif [[ -f "Makefile" ]]; then

make build

elif [[ -f "go.mod" ]]; then

go build -o "app-$BUILD_VERSION" .

fi

}

```

通过这些自动化脚本和工具链整合，DevOps工程师可以构建高效、可靠的运维体系，实现基础设施的自动化管理，提升系统稳定性和部署效率。

ITPub博客

Linux自动化运维：脚本编写与工具链整合实践

最新文章