#!/usr/bin/env bash
# 不自动运行：线上问题的“第一分钟”快照，只读命令，不修改任何东西
# 用法：bash diag.sh [进程名关键字] > diag-$(date +%F-%H%M).txt
set -uo pipefail

keyword="${1:-}"
section() { printf '\n===== %s =====\n' "$1"; }

section "时间和负载"
date
uptime

section "CPU 占用最高的进程"
ps -eo pid,ppid,user,%cpu,%mem,etime,cmd --sort=-%cpu | head -n 10

section "内存"
free -h

section "磁盘空间和 inode"
df -h -x tmpfs -x devtmpfs
df -i -x tmpfs -x devtmpfs | awk 'NR == 1 || $5+0 > 80'

section "监听端口"
ss -lntp 2>/dev/null | head -n 30

section "TCP 连接状态统计"
ss -ant | awk 'NR > 1 {count[$1]++} END {for (s in count) print s, count[s]}'

if [[ -n "$keyword" ]]; then
  section "进程：$keyword"
  pgrep -af -- "$keyword" || echo "没有找到进程"
fi

section "最近的内核日志（OOM 等）"
if kernel_log="$(journalctl -k --since "1 hour ago" --no-pager 2>/dev/null)" || kernel_log="$(dmesg 2>/dev/null)"; then
  grep -iE 'oom|killed process' <<<"$kernel_log" | tail -n 20 || echo "最近没有 OOM 记录"
else
  echo "无权限读取内核日志"
fi