#!/bin/bash

tempClientUsage=/tmp/auditd_client_usage.tmp
currentClientUsage=/tmp/auditd_client_usage.current
previousClientUsage=/tmp/auditd_client_usage.previous
tempClientList=/tmp/auditd_client_list.tmp
currentClientList=/tmp/auditd_client_list.current
previousClientList=/tmp/auditd_client_list.previous
clientListDiff=/tmp/auditd_client_list.diff
clientListAdded=/tmp/auditd_client_list.added
clientListRemoved=/tmp/auditd_client_list.removed
emailContent=/tmp/auditd_client_report.email
emailRecipients="vumc.it.linux@vumc.org"
#emailRecipients="chad.m.wigal@vumc.org michael.shute@vumc.org jeff.neely@vumc.org james.c.buckley@vumc.org wilbur.longwisch@vumc.org kyle.england@vumc.org"
myDate=`date "+%m-%d-%Y"`
thisHost=`hostname`

> $tempClientUsage
> $tempClientList

mv $currentClientUsage $previousClientUsage
mv $currentClientList $previousClientList
#cp -p /tmp/auditd_client_list.master $previousClientList

total=`grep "node=" /app001/auditd/audit.log.1 /app001/auditd/audit.log.6 /app001/auditd/audit.log.11 /app001/auditd/audit.log.16 /app001/auditd/audit.log.21 /app001/auditd/audit.log.26 | wc -l`

for host in `netstat -ap | grep ":60 [a-z]" | grep -v -i listen | awk {'print $5'} | sed 's/\..*$//' | sed 's/-cs//' | sort | uniq`
do
  echo "$host" >> $tempClientList
  portion=`grep node=$host /app001/auditd/audit.log.1 /app001/auditd/audit.log.6 /app001/auditd/audit.log.11 /app001/auditd/audit.log.16 /app001/auditd/audit.log.21 /app001/auditd/audit.log.26 | wc -l`
  ratio=`echo "scale=6; $portion/$total" | bc`
  cur_percentage=`echo "scale=4; $ratio*100" | bc | sed 's/.\{3\}$//'`
  echo -e "$host   \t$cur_percentage" >> $tempClientUsage
done

sort -n -r -k 2 $tempClientUsage > $currentClientUsage
sort $tempClientList > $currentClientList

cp -p $currentClientList /tmp/auditd_client_list.${myDate}

echo -e "\nRecent log usage per client" >> $emailContent
echo -e "\nClient    \tPercentage" >> $emailContent
echo -e "======    \t==========" >> $emailContent

cat $currentClientUsage >> $emailContent

diff $previousClientList $currentClientList > $clientListDiff

> $clientListAdded
> $clientListRemoved
cat $clientListDiff | grep "^>" | awk {'print $2'} >> $clientListAdded
cat $clientListDiff | grep "^<" | awk {'print $2'} >> $clientListRemoved

echo -e "\n\nThe following clients have been ADDED since the last report" >> $emailContent
if [ -s "$clientListAdded" ]; then
   cat $clientListAdded >> $emailContent
else
   echo "NONE" >> $emailContent
fi

echo -e "\n\nThe following clients have been REMOVED since the last report" >> $emailContent
if [ -s "$clientListRemoved" ]; then
   cat $clientListRemoved >> $emailContent
else
   echo "NONE" >> $emailContent
fi

cat $emailContent | mail -s "Auditd Client Report for ${thisHost}" $emailRecipients

rm $emailContent
