readahead-collect

readahead-collect (text/plain), 1.58 KB, created by Siuchung Cheung (Clement) on 2010-10-02 23:48:38 UTC

#!/bin/bash

source /etc/conf.d/readahead-list

exclude_files=(
  /sbin/auditd
  /etc/init.d/auditd
  /etc/audit/
  /var/log/audit
  /lib64/rc/init.d/daemons/auditd
  /etc/conf.d/auditd
  /sbin/auditctl
  /var/run
  /var/tmp
  /tmp
)

declare -A seen_file

function file_exclude
{
  for exclude in ${exclude_files[@]}; do
    if [[ $1 =~ $exclude ]]; then
      return 0
    fi
  done

  return 1
}

function get_path
{
  if [[ ${1:0:1} == '/' ]]; then
    real_file=`realpath $1 2>/dev/null`
  else
    real_file=`realpath $2/$1 2>/dev/null`
  fi

  if [[ -n $real_file ]] &&
     ! file_exclude $real_file &&
     ! (( ${seen_file[$real_file]} )); then
   echo $real_file
   seen_file[$real_file]=1
  fi
}

function proc_lines
{
  while read line; do
    if [[ $line =~ .*name=(.*)\ inode=.* ]]; then
      file=${BASH_REMATCH[1]}
      continue
    fi
    if [[ $line =~ .*cwd=(.*) ]]; then
      cwd=${BASH_REMATCH[1]}
      continue
    fi
    if [[ $line =~ .*exe=(.*)\ key=.* ]]; then
      exe=${BASH_REMATCH[1]}
      if [[ $exe == '/sbin/rc' && $line =~ .*comm=bootmisc\ exe=.* ]]; then
        return
      fi
      continue
    fi
    if [[ $line == '----' && -n $file ]]; then
      get_path $file $cwd
      get_path $exe $cwd
      unset file
      unset cwd
      unset exe
      unset comm
    fi
  done
}

function proc_list
{
  echo "Prossing early list into $READAHEAD_LIST_runlevel_boot"
  proc_lines early  > $READAHEAD_LIST_runlevel_boot
  echo "Prossing main list into $READAHEAD_LIST_runlevel_default"
  proc_lines main > $READAHEAD_LIST_runlevel_default
}

ausearch -i -k bootup | proc_list