#!/bin/bash

usage() {

$0 - configuration and log data collector

USAGE: $0 [options]

Collects configuration and log data for Foreman, Smart Proxies, backend

services and system information while removing security information like

passwords, tokens and keys.

backend services separately.

OPTIONS:

-d DIR Directory to place the tarball in (default /tmp/foreman-XYZ)

-g Skip generic info (CPU, memory, firewall etc.)

-a Do not generate a tarball from the resulting directory

-m NUM Maximum lines to keep for each file (default 5000)

-j PRG Filter with provided program when creating a tarball

-v Verbose mode

USAGE

You may want to upload the tarball (with -u) to our public server via rsync.

This is a write-only directory (readable only by Foreman core developers)

Please note that the rsync transmission is UNENCRYPTED.

UPLOADUSAGE

# filter for patterns like password=XYZ or secret: abc!@#$123

FILTER_WORDS=(

password

PASSWORD

default_password

secret

token

api_token

oauth_secret

keystorePass

truststorePass

)

FILTER_WORDS_STR=$(IFS=$'|'; echo "${FILTER_WORDS[*]}")

FILTER="s/($FILTER_WORDS_STR)(\s*[:=]\s*)\S+/\1\2\*\*\*\*\*/g"

error() {

echo $* >&2

}

qprintf() {

[ $QUIET -ne 1 ] && printf "$@"

}

printv() {

[ $QUIET -ne 1 ] && [ $VERBOSE -eq 1 ] && echo $*

}

while read -e -t 0.1; do : ; done

}

add_cmd() {

CMD=$1

OUT=$2

printv " - $OUT"

echo -e "COMMAND> $CMD\n" > "$DIR/$OUT"

eval $CMD >> "$DIR/$OUT" 2>&1

}

# add and filter if it is a non zero, readable, regular file or symlink (skip otherwise)

add_files() {

for FILE in $*; do

if [ \( -f "$FILE" -o -h "$FILE" \) -a \( -r "$FILE" -a -s "$FILE" \) ]; then

printv " - $FILE"

SUBDIR=$(dirname $FILE)

[ ! -d "$DIR$SUBDIR" ] && mkdir -p "$DIR$SUBDIR"

tail -n "$MAXLINES" "$FILE" | sed -r "$FILTER" > "$DIR$FILE"

[ $PRINTPASS -eq 1 ] && grep -E "($FILTER_WORDS_STR)" "$DIR$FILE"

fi

done

}

NOGENERIC=0

NOTAR=0

MAXLINES=5000

COMPRESS=""

PRINTPASS=0

QUIET=0

VERBOSE=0

DEBUG=0

if type -p xz >/dev/null; then

COMPRESS="xz -9"

EXTENSION=".xz"

elif type -p bzip2 >/dev/null; then

COMPRESS="bzip2 -9"

EXTENSION=".bz2"

elif type -p gzip >/dev/null; then

COMPRESS="gzip -9"

EXTENSION=".gz"

else

COMPRESS="cat"

EXTENSION=""

fi

CONF_FILE=/usr/share/foreman/config/foreman-debug.conf

test -f $CONF_FILE && source $CONF_FILE

d)

DIR="$OPTARG"

;;

g)

NOGENERIC=1

;;

a)

NOTAR=1

;;

p)

PRINTPASS=1

;;

q)

QUIET=1

;;

v)

VERBOSE=1

;;

m)

MAXLINES="$OPTARG"

;;

j)

COMPRESS="$OPTARG"

EXTENSION=".$(echo "$OPTARG" | awk '{ print $1 }')"

;;

UPLOAD=1

;;

# this option is not docummented - use for extra output,

# skip slow items and to disable root check

DEBUG=1

;;

h)

usage

exit

;;

?)

error "Invalid option: $OPTARG"

usage

exit

;;

esac

done

[ $DEBUG -eq 0 -a $EUID -ne 0 ] && error "This script must be run as root" && exit 1

if [ -f /etc/debian_version ]; then

OS=debian

OS=redhat

OS_RELEASE=$(lsb_release -sr 2>/dev/null)

OS=$(rpm -q --whatprovides redhat-release --queryformat '%{NAME}')

OS_RELEASE=$(rpm -q --whatprovides redhat-release --queryformat '%{VERSION}')

else

OS=$(uname -s)

OS_RELEASE="Unknown"

fi

printv "Determined $OS distribution"

if [ -z "$DIR" ]; then

DIR=$(mktemp -d foreman-debug-XXXXX -p /tmp)

[ "$NOTAR" -eq 0 ] && trap "rm -rf $DIR" EXIT

else

[ ! -d "$DIR" ] && mkdir -p "$DIR"

fi

printv "Directory $DIR created"

TARBALL="$DIR.tar$EXTENSION"

# GENERIC ARTIFACTS

if [ $NOGENERIC -eq 0 ]; then

printv "Collecting generic system information"

add_cmd "uname -a" "uname"

add_cmd "cat /proc/cpuinfo" "cpuinfo"

add_cmd "cat /proc/meminfo" "meminfo"

add_cmd "ulimit -a" "ulimit"

add_cmd "lsmod" "lsmod"

add_cmd "iptables -L -v -n" "iptables"

add_cmd "ifconfig -a" "ifconfig"

add_cmd "route -n" "route"

add_cmd "netstat -tulpn" "netstat"

add_cmd "ip a" "ip_a"

add_cmd "ip r" "ip_r"

add_cmd "ss -tulpn" "ss"

add_cmd "cat /etc/hosts" "hosts"

add_cmd "ping -c1 -W1 localhost" "ping_localhost"

add_cmd "ping -c1 -W1 $(hostname)" "ping_hostname"

add_cmd "ping -c1 -W1 $(hostname -f)" "ping_hostname_full"

add_cmd "scl -l" "software_collections"

add_cmd "ausearch -m AVC -m USER_AVC -m SELINUX_ERR || grep AVC /var/log/audit/audit.log" "selinux_denials.log"

if [ -f /usr/sbin/selinuxenabled ] && /usr/sbin/selinuxenabled; then

add_cmd "sepolgen-ifgen &>/dev/null && audit2allow -Ra || audit2allow -a" "selinux_audit2allow"

add_cmd "semodule -l" "selinux_modules"

add_cmd "semanage boolean -l" "selinux_booleans"

add_cmd "semanage fcontext -l" "selinux_fcontext"

fi

if [ "$OS" = "redhat" ]; then

[ $DEBUG -eq 0 ] && add_cmd "rpm -qa" "installed_packages"

elif [ "$OS" = "debian" ]; then

[ $DEBUG -eq 0 ] && add_cmd "dpkg --list" "installed_packages"

fi

fi

# FOREMAN RELATED ARTIFACTS

printv "Collecting Foreman-related information"

add_cmd "puppet --version" "version_puppet"

add_cmd "gem list" "gem_list"

add_cmd "facter" "facts"

add_cmd "virsh list" "virsh_list"

add_files /etc/libvirt/* /etc/libvirt/storage/* /etc/libvirt/qemu/* /etc/libvirt/qemu/networks

add_files /var/lib/pgsql/data/*.conf

add_files /var/lib/puppet/ssl/certs/$(hostname -f).pem /var/lib/puppet/ssl/certs/ca.pem

add_files /etc/{httpd,apache2}/conf/*

add_files /etc/{httpd,apache2}/conf.d/*

add_files /etc/sysconfig/pgsql

if [ -d "/usr/share/foreman/script/foreman-debug.d" ]; then

if [ -x "$extension" ]; then

printv "Processing extension $extension"

source "$extension" 2>/dev/null

fi

fi

qprintf "%10s %s\n" "HOSTNAME:" "$(hostname -f 2>/dev/null)"

qprintf "%10s %s\n" "OS:" "$OS"

qprintf "%10s %s\n" "RELEASE:" "$OS_RELEASE"

qprintf "%10s %s\n" "FOREMAN:" "$(cat /usr/share/foreman/VERSION 2>/dev/null)"

qprintf "%10s %s\n" "RUBY:" "$(ruby --version 2>/dev/null)"

qprintf "%10s %s\n" "PUPPET:" "$(puppet --version 2>/dev/null)"

qprintf "%10s %s\n" "DENIALS:" "$(grep AVC /var/log/audit/audit.log | wc -l)"

if [ "$NOTAR" -eq 0 ]; then

else

qprintf "%s: %s\n\n" "A debug directory has been created" "$DIR"

fi

rsync $TARBALL rsync://theforeman.org/debug-incoming

qprintf "The tarball has been uploaded, please contact us on our mailing list or IRC\n"

qprintf " http://debugs.theforeman.org/$(basename $TARBALL)\n\n"