如何用脚本生成系统快照对比

本文目录导读：

1. Linux系统 - 使用Bash脚本
2. macOS系统 - 使用Shell脚本
3. Windows系统 - 使用PowerShell脚本
4. 综合监控脚本 (跨平台)
5. 使用方法

Linux系统 - 使用Bash脚本

基础快照脚本 (snapshot.sh)

#!/bin/bash
# 生成系统快照
timestamp=$(date +"%Y%m%d_%H%M%S")
snapshot_dir="/tmp/system_snapshots/$timestamp"
mkdir -p "$snapshot_dir"
# 收集系统信息
{
    echo "=== 系统信息 ==="
    uname -a
    echo ""
    echo "=== 系统版本 ==="
    cat /etc/os-release 2>/dev/null || cat /etc/redhat-release 2>/dev/null
    echo ""
    echo "=== 安装的软件包 ==="
    dpkg -l 2>/dev/null || rpm -qa 2>/dev/null
    echo ""
    echo "=== 运行中的服务 ==="
    systemctl list-units --type=service --state=running 2>/dev/null
    echo ""
    echo "=== 网络配置 ==="
    ip addr show 2>/dev/null || ifconfig
    echo ""
    echo "=== 磁盘使用情况 ==="
    df -h
    echo ""
    echo "=== 进程列表 ==="
    ps aux --sort=-%mem | head -20
    echo ""
    echo "=== 端口监听 ==="
    ss -tlnp 2>/dev/null || netstat -tlnp
    echo ""
    echo "=== 用户列表 ==="
    cat /etc/passwd | grep -E "/home|/root" | cut -d: -f1,3,6,7
    echo ""
    echo "=== cron任务 ==="
    for user in $(cut -f1 -d: /etc/passwd); do
        crontab -u $user -l 2>/dev/null
    done
} > "$snapshot_dir/system_snapshot.txt"
# 生成校验和文件
find /etc /var/log /home -type f -name "*.conf" -o -name "*.log" 2>/dev/null | \
    xargs -I {} md5sum {} 2>/dev/null > "$snapshot_dir/checksums.txt"
echo "快照已保存至: $snapshot_dir"
echo "MD5: $(md5sum $snapshot_dir/system_snapshot.txt | cut -d' ' -f1)"

比较脚本 (compare.sh)

#!/bin/bash
# 快速比较两个快照
if [ $# -ne 2 ]; then
    echo "用法: $0 <快照1目录> <快照2目录>"
    exit 1
fi
echo "=== 系统快照比较 ==="
echo "比较: $1 <-> $2"
echo ""
# 比较系统信息
diff -u "$1/system_snapshot.txt" "$2/system_snapshot.txt" | \
    grep -E "^[+-]" | grep -v "^[+-]{3}" > /tmp/snapshot_diff.txt
if [ -s /tmp/snapshot_diff.txt ]; then
    echo "发现的变更:"
    cat /tmp/snapshot_diff.txt
else
    echo "未检测到变更"
fi
# 比较校验和
echo ""
echo "=== 文件变更 ==="
diff "$1/checksums.txt" "$2/checksums.txt" | \
    grep -E "^[<>]" | awk '{print $2}' | sort -u

macOS系统 - 使用Shell脚本

#!/bin/bash
generate_macos_snapshot() {
    local snapshot_dir="/tmp/macos_snapshot_$(date +%Y%m%d_%H%M%S)"
    mkdir -p "$snapshot_dir"
    # macOS特定信息收集
    {
        echo "=== 系统信息 ==="
        sw_vers
        echo ""
        echo "=== 系统设置 ==="
        sysctl -a | head -50
        echo ""
        echo "=== 安装的应用程序 ==="
        system_profiler SPApplicationsDataType
        echo ""
        echo "=== Homebrew包 ==="
        brew list 2>/dev/null
        echo ""
        echo "=== 启动项 ==="
        launchctl list
        echo ""
        echo "=== 磁盘信息 ==="
        diskutil list
        echo ""
        echo "=== 网络配置 ==="
        ifconfig
        echo ""
        echo "=== 用户账户 ==="
        dscl . list /Users
    } > "$snapshot_dir/macos_snapshot.txt"
    echo "快照生成完成: $snapshot_dir"
}
generate_macos_snapshot

Windows系统 - 使用PowerShell脚本

# 生成系统快照
$timestamp = Get-Date -Format "yyyyMMdd_HHmmss"
$snapshotPath = "C:\SystemSnapshots\$timestamp"
New-Item -ItemType Directory -Force -Path $snapshotPath | Out-Null
# 收集系统信息
$snapshot = @{
    SystemInfo = Get-ComputerInfo
    Services = Get-Service | Where-Object {$_.Status -eq "Running"}
    Processes = Get-Process | Sort-Object CPU -Descending | Select-Object -First 50
    InstalledPrograms = Get-WmiObject -Class Win32_Product
    NetworkConfig = Get-NetAdapter
    Disk = Get-Disk | Select-Object FriendlyName, Size, HealthStatus
    UserAccounts = Get-LocalUser
    ScheduledTasks = Get-ScheduledTask | Where-Object {$_.State -eq "Running"}
}
# 保存为JSON
$snapshot | ConvertTo-Json -Depth 3 | Out-File "$snapshotPath\system_snapshot.json"
# 生成校验和
$excludePaths = @('C:\Windows', 'C:\Program Files', 'C:\Program Files (x86)')
Get-ChildItem -Path "C:\" -Recurse -ErrorAction SilentlyContinue | 
    Where-Object {$_.PSIsContainer -eq $false} |
    Where-Object {($excludePaths | ForEach-Object {$_.FullName -notlike "$_*"}) -contains $true} |
    ForEach-Object {Get-FileHash $_.FullName -Algorithm MD5 | Select-Object Path, Hash} |
    Export-Csv -Path "$snapshotPath\checksums.csv" -NoTypeInformation
Write-Host "快照已保存至: $snapshotPath"
# 比较两个快照的PowerShell函数
function Compare-SystemSnapshots {
    param(
        [Parameter(Mandatory=$true)]
        [string]$Snapshot1,
        [Parameter(Mandatory=$true)]
        [string]$Snapshot2
    )
    $snap1 = Get-Content $Snapshot1 | ConvertFrom-Json
    $snap2 = Get-Content $Snapshot2 | ConvertFrom-Json
    Write-Host "=== 系统快照比较 ===" -ForegroundColor Cyan
    Write-Host "比较: $Snapshot1 <-> $Snapshot2`n"
    # 比较服务状态
    $servicesChanged = Compare-Object -ReferenceObject $snap1.Services.name `
        -DifferenceObject $snap2.Services.name
    if ($servicesChanged) {
        Write-Host "服务变更:" -ForegroundColor Yellow
        $servicesChanged | ForEach-Object {
            "$($_.SideIndicator): $($_.InputObject)"
        }
    }
}

综合监控脚本 (跨平台)

#!/usr/bin/env python3
"""
跨平台系统快照生成与比较工具
"""
import os
import sys
import json
import hashlib
import datetime
import subprocess
import platform
class SystemSnapshot:
    def __init__(self):
        self.timestamp = datetime.datetime.now().strftime("%Y%m%d_%H%M%S")
        self.snapshot_dir = f"/tmp/system_snapshot_{self.timestamp}"
    def collect_system_info(self):
        info = {
            "timestamp": self.timestamp,
            "platform": platform.platform(),
            "hostname": platform.node()
        }
        # Linux系统
        if sys.platform.startswith('linux'):
            info.update(self._collect_linux_info())
        # macOS系统
        elif sys.platform == 'darwin':
            info.update(self._collect_macos_info())
        # Windows系统
        elif sys.platform == 'win32':
            info.update(self._collect_windows_info())
        return info
    def _collect_linux_info(self):
        info = {}
        # 系统负载
        try:
            load = subprocess.check_output(['uptime']).decode().strip()
            info['load'] = load
        except: pass
        # 内存使用
        try:
            mem = subprocess.check_output(['free', '-m']).decode().strip()
            info['memory'] = mem
        except: pass
        # 磁盘使用
        try:
            disk = subprocess.check_output(['df', '-h']).decode().strip()
            info['disk'] = disk
        except: pass
        # 网络连接
        try:
            net = subprocess.check_output(['ss', '-tlnp']).decode().strip()
            info['network'] = net
        except: pass
        # 包管理器信息
        if os.path.exists('/usr/bin/dpkg'):
            try:
                packages = subprocess.check_output(['dpkg', '-l']).decode().strip()
                info['packages'] = packages
            except: pass
        elif os.path.exists('/usr/bin/rpm'):
            try:
                packages = subprocess.check_output(['rpm', '-qa']).decode().strip()
                info['packages'] = packages
            except: pass
        return info
    def save_snapshot(self):
        os.makedirs(self.snapshot_dir, exist_ok=True)
        info = self.collect_system_info()
        # 保存为JSON
        with open(f"{self.snapshot_dir}/snapshot.json", 'w') as f:
            json.dump(info, f, indent=2)
        # 生成校验和
        with open(f"{self.snapshot_dir}/snapshot.json", 'rb') as f:
            content = f.read()
            md5 = hashlib.md5(content).hexdigest()
        with open(f"{self.snapshot_dir}/checksum.txt", 'w') as f:
            f.write(f"MD5: {md5}\n")
        print(f"快照已保存至: {self.snapshot_dir}")
        return self.snapshot_dir
    @staticmethod
    def compare_snapshots(snapshot1, snapshot2):
        with open(f"{snapshot1}/snapshot.json", 'r') as f:
            data1 = json.load(f)
        with open(f"{snapshot2}/snapshot.json", 'r') as f:
            data2 = json.load(f)
        print("\n=== 系统快照比较 ===")
        print(f"快照1: {data1['timestamp']}")
        print(f"快照2: {data2['timestamp']}")
        print()
        # 比较关键指标
        compare_fields = ['load', 'memory', 'disk', 'network']
        for field in compare_fields:
            if field in data1 and field in data2:
                if data1[field] != data2[field]:
                    print(f"[变更] {field}:")
                    print(f"  之前: {data1[field][:100]}...")
                    print(f"  之后: {data2[field][:100]}...")
                    print()
if __name__ == "__main__":
    if len(sys.argv) == 1:
        # 生成新快照
        snap = SystemSnapshot()
        snap.save_snapshot()
    elif len(sys.argv) == 3:
        # 比较两个快照
        SystemSnapshot.compare_snapshots(sys.argv[1], sys.argv[2])
    else:
        print("用法:")
        print("  生成快照: python snapshot.py")
        print("  比较快照: python snapshot.py <快照1目录> <快照2目录>")

使用方法

1. 生成快照:

   # Linux/macOS
   chmod +x snapshot.sh && ./snapshot.sh
   # Windows PowerShell
   powershell -ExecutionPolicy Bypass -File snapshot.ps1

2. 定期快照 (通过cron):

   # 每天凌晨2点生成快照
   0 2 * * * /path/to/snapshot.sh

3. 自动清理 (保留最近7天):

   find /tmp/system_snapshots/ -type d -mtime +7 -exec rm -rf {} \;

这些脚本会自动收集系统关键信息并生成可比较的快照,适用于系统审计、故障排查和变更检测场景。