#!/bin/bash
# Report accounts that exceed their PHP max_children at least two days in a row.

HOSTNAME=$(hostname)

EMAIL="sysadmin@sitioshispanos.com"

LOG_SRC="/opt/cpanel/"

LOG_PREFIX="ea-php"

LOG_FILE="root/var/log/php-fpm/error.log"

PHP_TARGET="max_children"

TDAY=$(date "+%d-%b-%Y")
YDAY=$(date -d "yesterday" "+%d-%b-%Y")

export INFRACTORS_LOG_TDAY=$(mktemp)
export INFRACTORS_LOG_YDAY=$(mktemp)

for php_log in $(find $LOG_SRC -maxdepth 1 -name "$LOG_PREFIX*"); do
  grep $PHP_TARGET $php_log/$LOG_FILE | while read -r line; do
    echo $line | grep "$TDAY" | awk '{print $4,$5}' >> $INFRACTORS_LOG_TDAY
    echo $line | grep "$YDAY" | awk '{print $4,$5}' >> $INFRACTORS_LOG_YDAY
  done
done

sort -o $INFRACTORS_LOG_TDAY $INFRACTORS_LOG_TDAY
sort -o $INFRACTORS_LOG_YDAY $INFRACTORS_LOG_YDAY

comm -12 $INFRACTORS_LOG_TDAY $INFRACTORS_LOG_YDAY | uniq \
| mail -s "PHP pools abusing PHP max_children on $HOSTNAME" $EMAIL