Linux lsmod命令

Module                  Size  Used by
usb_storage            65536  1
uas                    24576  0
nls_utf8               16384  1
isofs                  45056  1
fuse                  139264  3
nls_iso8859_1          16384  1
usbhid                 57344  0
hid                   135168  2 usbhid,hid_generic

#!/bin/bash
# 硬件驱动故障排除脚本

echo "=== 硬件驱动检查 ==="

# 检查USB驱动
echo "1. USB相关模块:"
lsmod | grep -E "(usb|uhci|ohci|ehci|xhci)" | while read line; do
    echo "   $line"
done

# 检查网络驱动
echo ""
echo "2. 网络相关模块:"
NET_MODULES=$(lsmod | grep -E "(eth|net|wireless|wlan|ath|rtl|iwl)" | wc -l)
if [ $NET_MODULES -gt 0 ]; then
    lsmod | grep -E "(eth|net|wireless|wlan|ath|rtl|iwl)" | while read line; do
        echo "   $line"
    done
else
    echo "   未检测到网络驱动模块"
fi

# 检查图形驱动
echo ""
echo "3. 图形相关模块:"
if lsmod | grep -q "nvidia"; then
    echo "   NVIDIA驱动已加载"
elif lsmod | grep -q "amdgpu"; then
    echo "   AMD GPU驱动已加载"
elif lsmod | grep -q "i915"; then
    echo "   Intel集成显卡驱动已加载"
else
    echo "   未检测到专用图形驱动"
fi

# 检查存储驱动
echo ""
echo "4. 存储相关模块:"
lsmod | grep -E "(sd|ahci|nvme|scsi|sata)" | head -5 | while read line; do
    echo "   $line"
done

echo ""
echo "=== 检查完成 ==="

#!/bin/bash
# 系统安全审计 - 内核模块检查

echo "=== 内核模块安全审计 ==="
echo "审计时间: $(date)"
echo ""

# 1. 检查可疑模块
SUSPICIOUS_PATTERNS="(sniffer|keylogger|rootkit|backdoor|hack)"
echo "1. 可疑模块检查:"
SUSPICIOUS_FOUND=$(lsmod | grep -i -E "$SUSPICIOUS_PATTERNS")
if [ -n "$SUSPICIOUS_FOUND" ]; then
    echo "   警告：发现可疑模块！"
    echo "$SUSPICIOUS_FOUND" | while read line; do
        echo "   ! $line"
    done
else
    echo "   未发现明显可疑模块"
fi

# 2. 检查隐藏模块（通过/proc/modules对比）
echo ""
echo "2. 隐藏模块检查:"
LSMOD_COUNT=$(lsmod | wc -l)
PROC_MODULES_COUNT=$(cat /proc/modules | wc -l)

if [ "$LSMOD_COUNT" -ne "$PROC_MODULES_COUNT" ]; then
    echo "   警告：lsmod和/proc/modules模块数量不一致！"
    echo "   lsmod显示: $((LSMOD_COUNT-1)) 个模块"
    echo "   /proc/modules显示: $PROC_MODULES_COUNT 个模块"
    echo "   可能存在隐藏模块"
else
    echo "   lsmod和/proc/modules模块数量一致"
fi

# 3. 检查无线网络监控模块
echo ""
echo "3. 无线网络监控模块:"
MONITOR_MODULES="(ath9k|rtl8187|rt2800usb)"
MONITOR_FOUND=$(lsmod | grep -E "$MONITOR_MODULES")
if [ -n "$MONITOR_FOUND" ]; then
    echo "   发现无线监控相关模块:"
    echo "$MONITOR_FOUND" | while read line; do
        echo "   $line"
    done
else
    echo "   未发现无线监控相关模块"
fi

# 4. 检查虚拟化相关模块
echo ""
echo "4. 虚拟化相关模块:"
VIRT_MODULES=$(lsmod | grep -E "(kvm|virt|vbox|vmware)" | wc -l)
if [ $VIRT_MODULES -gt 0 ]; then
    echo "   发现虚拟化相关模块 ($VIRT_MODULES 个):"
    lsmod | grep -E "(kvm|virt|vbox|vmware)" | while read line; do
        echo "   $line"
    done
else
    echo "   未发现虚拟化相关模块"
fi

echo ""
echo "=== 审计完成 ==="
echo "建议：定期检查模块列表，注意异常模块加载"

#!/bin/bash
# 内核模块性能监控脚本

echo "=== 内核模块性能监控 ==="
echo "监控时间: $(date)"
echo "监控间隔: 5秒"
echo "按 Ctrl+C 停止监控"
echo ""

# 创建临时文件记录初始状态
TEMP_FILE=$(mktemp)
lsmod > "$TEMP_FILE"

# 监控循环
while true; do
    clear
    echo "=== 内核模块性能监控 ==="
    echo "时间: $(date)"
    echo ""

    # 获取当前模块状态
    CURRENT_MODULES=$(mktemp)
    lsmod > "$CURRENT_MODULES"

    # 1. 模块变化检测
    echo "1. 模块变化检测:"
    NEW_MODULES=$(comm -13 "$TEMP_FILE" "$CURRENT_MODULES" | grep -v "Module" | wc -l)
    REMOVED_MODULES=$(comm -23 "$TEMP_FILE" "$CURRENT_MODULES" | grep -v "Module" | wc -l)

    if [ "$NEW_MODULES" -gt 0 ]; then
        echo "   新加载模块: $NEW_MODULES 个"
        comm -13 "$TEMP_FILE" "$CURRENT_MODULES" | tail -n +2 | while read line; do
            echo "   + $(echo $line | awk '{print $1}')"
        done
    else
        echo "   无新模块加载"
    fi

    if [ "$REMOVED_MODULES" -gt 0 ]; then
        echo "   已卸载模块: $REMOVED_MODULES 个"
        comm -23 "$TEMP_FILE" "$CURRENT_MODULES" | tail -n +2 | while read line; do
            echo "   - $(echo $line | awk '{print $1}')"
        done
    else
        echo "   无模块卸载"
    fi

    # 2. 内存使用统计
    echo ""
    echo "2. 内存使用统计:"
    TOTAL_MEM=$(lsmod | tail -n +2 | awk '{sum += $2} END {print sum/1024}')
    echo "   总内存占用: ${TOTAL_MEM} KB"

    # 3. 使用计数监控
    echo ""
    echo "3. 高使用率模块:"
    lsmod | tail -n +2 | awk '
    $3 ~ /^[0-9]+$/ && $3 > 5 {
        printf "   %-25s 使用计数: %d\n", $1, $3
    }' | head -5

    # 4. 监控特定关键模块
    echo ""
    echo "4. 关键模块状态:"
    for module in ext4 fuse overlay nfs usb_storage; do
        if grep -q "^$module " "$CURRENT_MODULES"; then
            STATUS=$(grep "^$module " "$CURRENT_MODULES" | awk '{print "大小: " $2/1024 " KB, 使用: " $3}')
            echo "   $module: ✓ $STATUS"
        else
            echo "   $module: ✗ 未加载"
        fi
    done

    # 更新临时文件
    cp "$CURRENT_MODULES" "$TEMP_FILE"

    # 清理临时文件
    rm -f "$CURRENT_MODULES"

    # 等待5秒
    echo ""
    echo "下次更新: 5秒后..."
    sleep 5
done

# 清理
rm -f "$TEMP_FILE"