mochahochabeachside.com

This is probably the longest one-liner I've ever seen.  A co-worker of mine came up with this as a panic button idea for when server load suddenly skyrockets above 100, and you've got to get it down NOW.   Essentially, it kills the load-bearing services (httpd, mysqld, exim, spamd), restartes them, renices them to +19, drops you into a pseudo-shell to allow you to gather evidence and mitigate, and then restores them to normal service with their proper 'nice' level.

killall -9 php httpd spamd exim; killall -6 mysqld;ps faux|grep -i mysql[d]|awk '{print "kill -9 "$2}'|sh;/etc/init.d/httpd startssl ; ps faux|grep htt[p]d|awk '{print "renice +19 "$2}'|sh;/etc/init.d/mysql start ; ps faux|grep mys[q]ld|awk '{print "renice +19 "$2}'|sh;/etc/init.d/spamassassin start ; ps faux|grep spam[d]|awk '{print "renice +19 "$2}'|sh;/etc/init.d/exim start ; ps faux|grep e[x]im|awk '{print "renice +19 "$2}'|sh; watch "w; echo ; echo watch this until time to mitigate:; echo procs:; ps aufx|awk '{print \$1}'|sort -rn|uniq -c|grep -vi user|sort -nr|head -5; echo Scores:; scoreboard|awk '{print \$2}'|sort -rn|uniq -c|sort -rn|head -5; echo mysql:; mysqladmin pr|awk -F '|' '{print \$3}'|sort -rn|uniq -c|sort -rn|head -5; echo Connections:; netstat -ntpa|grep \:|sed s/:[^\ ]/\ /g|awk '{print \$6}'|sort|uniq -c|sort -rn|head -5;echo Mail:; exim -bp|exiqsumm -c|grep \\\\.|head -5;";echo "Time to mitigate! When you are finished, type exit...";sh;killall -9 php httpd spamd exim; killall -6 mysqld;/etc/init.d/httpd startssl ; /etc/init.d/mysql start ; /etc/init.d/spamassassin start ; /etc/init.d/exim start;echo "Finished load mitigation successfully\!";echo ; echo ; echo "Listener Check:"; netstat -ntpa|grep -i listen|sed s/\\//\ /g|awk '{print $8}'|sort|uniq -c|sort -rn;echo "press enter to continue..."; read ; top cd1

Yeah... that's a 1.3k one-liner.
Let's hear it for kludging!

Today, I had an instance where a customer's site had been attacked with a code injection affected all of his .php files. In this case, it was an old vBulletin install that had several known exploits on milw0rm (proof you should update often) that caused it.

Fortunately, the code was injected as a single line, and was the same in every file, and had the added benefit of being on the top line of the file.  So, I could use abit of perl to remove it, and then a bit of sed magic to remove the blank line left by Perl (because for some reason, it didn't want to remove the newline).

(continue reading...)

This little one-liner will automatically change the collation and character set for every table in a database, including the database itself.  The only thing it doesn't do is change the collation/charset of the individual columns in a table (I have yet to find a one-liner that works for that, but I keep trying).

for i in `mysqldump --add-drop-table --no-data DBNAME | grep ^DROP | awk '{print $5}' | cut -d\\\` -f2`;do mysql -e "ALTER TABLE ${i} CHARACTER SET charset COLLATE coll_ati_on;" DBNAME;done && mysql -e "ALTER DATABASE database CHARACTER SET charset COLLATION coll_ati_on;" DBNAME

If you happen to come up with something to do the columns as well, for the love of all that's holy, let me know.