Scripts

Practical scripts, SQL queries, and configuration examples for Linux, infrastructure, databases, security, monitoring, and data analysis.

Review every script before running it, test against non-production systems, and adapt paths, credentials, permissions, thresholds, and retention to your environment.

Quick Start

git clone https://github.com/sinsausti/Scripts.git
cd Scripts
./tests/run-tests.sh
./bash/system-health-report.sh -o health.txt

Destructive or state-changing examples use a dry run by default where practical. Generated reports, snapshots, manifests, and backup files may contain sensitive information.

Bash

• system-health-report.sh — Collect CPU, memory, storage, services, sockets, and recent warnings.
• network-baseline.sh — Capture addresses, routes, listeners, resolver state, and firewall configuration.
• incident-snapshot.sh — Collect volatile Linux state and generate a SHA-256 manifest.
• backup-integrity-check.sh — Check backup age, size, and an optional checksum manifest.
• tls-check.sh — Validate TLS connection, hostname, chain, and expiration.
• failed-login-summary.sh — Summarize SSH failures by source address and username.
• port-exposure-check.sh — Compare local listening sockets with an explicit allowlist.
• proxmox-lxc-clone.sh — Preview or create sequential Proxmox VE LXC clones.
• mysql-logical-backup.sh — Create atomic, compressed MySQL logical backups with checksums and retention.
• postgres-logical-backup.sh — Create PostgreSQL custom-format dumps, globals, manifests, and restore listings.
• database-restore-test.sh — Restore a logical backup into a temporary PostgreSQL or MySQL container.
• backup-metrics.sh — Export backup freshness, size, and verification metrics for Node Exporter.
• database-incident-snapshot.sh — Capture read-only PostgreSQL or MySQL incident state.
• systemd-service-audit.sh — Audit failed/enabled units, restarts, timers, definitions, and hardening.
• mysql-table-health.sh — Preview or run controlled MySQL table checks and analysis.
• sync-directories.sh — Synchronize selected remote directories with an explicit dry-run/apply workflow.

Use -h for Bash command help. Most scripts return 0 for success, 1 for a detected operational problem, and 2 for invalid input or a missing prerequisite.

./bash/system-health-report.sh -o health.txt
./bash/network-baseline.sh -o baseline.txt
./bash/incident-snapshot.sh -o incident-2026-09-05 --sudo
./bash/tls-check.sh -w 30 example.com:443
./bash/proxmox-lxc-clone.sh --source 9000 --first-id 110 --count 3 \
  --hostname-prefix lab
./bash/mysql-logical-backup.sh --host db.example.net --database app \
  --defaults-file "$HOME/.my.cnf" --output-dir /backup/mysql
./bash/postgres-logical-backup.sh --host db.example.net --database app \
  --output-dir /backup/postgresql
./bash/database-restore-test.sh --engine postgresql --backup app.dump
./bash/backup-metrics.sh --path /backup/postgresql --job postgresql \
  --output /var/lib/node_exporter/textfile_collector/backup.prom
./bash/sync-directories.sh --remote user@server --source /srv \
  --target /backup --subdir data

Python

The Python tools use only the standard library and require Python 3.9 or newer.

• csv-profile.py — Profile nulls, cardinality, inferred type, numeric range, and common values.
• latency-summary.py — Calculate mean, p50, p90, p95, p99, and maximum latency.
• log-frequency.py — Count frequent messages or regex capture groups.
• data-quality-check.py — Apply required, unique, timestamp, and numeric-range rules to CSV.
• risk-register-validator.py — Validate required cybersecurity risk-register fields and review dates.
• checksum-manifest.py — Create and verify portable SHA-256 directory manifests.
• ssh-run.py — Run a command concurrently on known SSH hosts without invoking a local shell.
• disk-growth-forecast.py — Estimate growth rate and capacity-threshold dates from CSV history.
• certificate-inventory.py — Verify and inventory TLS certificates as CSV or JSON.
• config-drift-check.py — Detect content, permission, ownership, and path drift.
• log-redactor.py — Redact secrets, credentials, addresses, emails, and custom patterns from logs.

./python/csv-profile.py metrics.csv
./python/latency-summary.py metrics.csv --column duration_ms
./python/checksum-manifest.py create backups SHA256SUMS
./python/checksum-manifest.py verify backups SHA256SUMS
./python/ssh-run.py admin@db1 admin@db2 --command 'uptime'
./python/disk-growth-forecast.py examples/disk-growth.csv \
  --capacity 107374182400 --group-column filesystem
./python/certificate-inventory.py example.com:443 --json
./python/config-drift-check.py create baseline.json /etc/ssh /etc/mysql
./python/config-drift-check.py verify baseline.json
./python/log-redactor.py application.log -o application.redacted.log

SQL

• postgresql-health-queries.sql
• mysql-health-queries.sql
• latency-percentiles-postgresql.sql
• duplicate-data-checks.sql
• time-series-gap-detection.sql
• incident-timeline.sql

SQL files are templates. Confirm engine version, privileges, object names, query plans, and production impact before running them.

Configuration Examples

• virtualhost.conf — Apache HTTP Server 2.4 virtual host.
• mysql-client.cnf.example — MySQL client option-file template.
• port-allowlist.txt — Listener allowlist template.
• disk-growth.csv — Capacity forecast input example.
• tls-targets.txt — TLS inventory target-list example.

Protect a populated MySQL option file with mode 0600. Never commit it.

Validation

Run the dependency-free test suite from the repository root:

./tests/run-tests.sh

The suite checks Bash syntax, command help, and the Python tools with temporary fixtures. SQL templates still require review and testing against the intended database version.

Requirements

• Operational Bash tools target modern Linux distributions and Bash 4 or newer.
• Python tools require Python 3.9 or newer and use only the standard library.
• Individual scripts report missing external commands before doing work.
• MySQL and PostgreSQL templates must be matched to the deployed server version.
• Restore tests require a running Docker-compatible daemon and may pull database images.
• Linux-specific collectors assume GNU core utilities and systemd where documented.