main.py

#!/usr/bin/env python3
# -*- coding:utf-8 -*-

"""
操作系统批量巡检工具 v3.2 (性能优化版)
功能：
- 生成 Excel 批量巡检模板，主机名自动探测
- 并发 SSH 远程执行系统巡检 (优化防卡死)
- 检测系统信息、安全、僵尸进程、磁盘I/O、中间件端口、性能、服务、日志、网络
- 定时任务精准过滤（剔除环境变量，只显示真实任务）
- 网络连接状态使用 ss 命令，无 netstat 依赖
- 生成 Word 格式专业报告（含运维单位/人员、状态着色、进度条）
- 报告文件名格式：IP地址_巡检报告_时间.docx
- 新增：深度中间件巡检 (Nginx/Redis/Kafka/ES/Tomcat/MySQL/Oracle/达梦等)
- 新增：DEBUG 级详细执行日志，便于排查问题
- 修复：加载Excel时自动检测并加密明文密码，防止泄露
- 优化：解决 yum check-update 等命令导致的巡检卡死问题
"""

# ------------------------------------------------------------
# 强制导入 idna 编码，解决 PyInstaller 打包后编码缺失问题
# ------------------------------------------------------------
import encodings.idna

import warnings
warnings.filterwarnings("ignore", category=DeprecationWarning)
warnings.filterwarnings("ignore", category=FutureWarning)
warnings.filterwarnings("ignore", category=UserWarning)

import os
import sys
import logging
import subprocess
import platform
import re
import getpass
import base64
import time
import select
from datetime import datetime
from pathlib import Path
from concurrent.futures import ThreadPoolExecutor, as_completed

# ------------------------------------------------------------
# 配置双日志系统：主日志(INFO) + 调试日志(DEBUG)
# ------------------------------------------------------------
logging.getLogger("paramiko").setLevel(logging.WARNING)

# 主日志 (仅文件)
logger = logging.getLogger(__name__)
logger.setLevel(logging.DEBUG)  # 记录所有级别
if not logger.handlers:
    # 普通 INFO 日志
    fh_info = logging.FileHandler('/tmp/os_batch_inspector.log', encoding='utf-8')
    fh_info.setLevel(logging.INFO)
    fh_info.setFormatter(logging.Formatter('%(asctime)s - %(name)s - %(levelname)s - %(message)s'))
    
    # 详细 DEBUG 日志 (用于排查问题)
    fh_debug = logging.FileHandler('/tmp/os_inspector_debug.log', encoding='utf-8')
    fh_debug.setLevel(logging.DEBUG)
    fh_debug.setFormatter(logging.Formatter('%(asctime)s - %(name)s - %(levelname)s - [%(filename)s:%(lineno)d] - %(message)s'))
    
    logger.addHandler(fh_info)
    logger.addHandler(fh_debug)

# ------------------------------------------------------------
# 依赖库检查与导入
# ------------------------------------------------------------
def check_dependencies():
    missing = []
    try:
        import paramiko
    except ImportError:
        missing.append("paramiko")
    try:
        import docx
        from docx.shared import Cm, Pt, RGBColor
        from docx.enum.text import WD_ALIGN_PARAGRAPH
        from docx.oxml.ns import qn
    except ImportError:
        missing.append("python-docx")
    try:
        import openpyxl
        from openpyxl.styles import Font, PatternFill, Alignment
    except ImportError:
        missing.append("openpyxl")
    try:
        from cryptography.fernet import Fernet
        from cryptography.hazmat.primitives import hashes
        from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
    except ImportError:
        missing.append("cryptography")
    if missing:
        print("❌ 缺少必需库: " + ", ".join(missing))
        print("请执行: pip install " + " ".join(missing))
        sys.exit(1)

check_dependencies()

# 导入并设置全局可用标志
try:
    import paramiko
except ImportError:
    paramiko = None

try:
    import docx
    from docx.shared import Cm, Pt, RGBColor
    from docx.enum.text import WD_ALIGN_PARAGRAPH
    from docx.oxml.ns import qn
    HAS_DOCX = True
except ImportError:
    HAS_DOCX = False

try:
    import openpyxl
    from openpyxl.styles import Font, PatternFill, Alignment, Border, Side
    from openpyxl.utils import get_column_letter
    HAS_EXCEL = True
except ImportError:
    HAS_EXCEL = False

try:
    from cryptography.fernet import Fernet
    from cryptography.hazmat.primitives import hashes
    from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
except ImportError:
    Fernet = None

if paramiko is None:
    print("❌ paramiko 未安装，无法进行远程 SSH 巡检")
    sys.exit(1)

# ------------------------------------------------------------
# 工具函数
# ------------------------------------------------------------
def clean_string(text):
    """清理 XML 非法字符"""
    if text is None:
        return ""
    text = str(text)
    cleaned = ""
    for ch in text:
        if ch == '\t' or ch == '\n' or ch == '\r':
            cleaned += ch
        elif ord(ch) >= 32:
            cleaned += ch
    cleaned = re.sub(r'[\x00-\x08\x0b-\x0c\x0e-\x1f\x7f-\x9f]', '', cleaned)
    return cleaned.strip()

def run_local_cmd(cmd, timeout=30):
    """执行本地 shell 命令，返回 stdout, stderr, rc (强制超时保护)"""
    logger.debug(f"[本地命令] 执行: {cmd} (超时: {timeout}s)")
    try:
        proc = subprocess.run(
            cmd,
            shell=True,
            stdout=subprocess.PIPE,
            stderr=subprocess.PIPE,
            universal_newlines=True,
            timeout=timeout,
            encoding='utf-8',
            errors='ignore'
        )
        logger.debug(f"[本地命令] 返回码: {proc.returncode}, 输出: {proc.stdout.strip()[:200]}")
        return proc.stdout.strip(), proc.stderr.strip(), proc.returncode
    except subprocess.TimeoutExpired:
        logger.warning(f"[本地命令] 超时 ({timeout}s): {cmd}")
        return "", "Timeout", -1
    except Exception as e:
        logger.error(f"[本地命令] 异常: {cmd}, {e}")
        return "", str(e), -1

def safe_int(val, default=0):
    """安全转换为整数"""
    if val is None:
        return default
    try:
        if isinstance(val, str) and val.strip().isdigit():
            return int(val.strip())
        return int(val) if not isinstance(val, str) else default
    except (ValueError, TypeError):
        return default

def is_error_output(output):
    """判断命令输出是否为错误信息"""
    if not output:
        return False
    error_indicators = ("错误:", "SSH执行失败:", "命令执行失败", "Timeout")
    return any(output.startswith(e) for e in error_indicators)

# ------------------------------------------------------------
# 密码加密管理器
# ------------------------------------------------------------
class PasswordEncryptor:
    def __init__(self, master_key=None):
        self.master_key = master_key or self._get_default_master_key()
        self.fernet = self._create_fernet(self.master_key)

    def _get_default_master_key(self):
        try:
            machine_id = platform.node()
            system_info = platform.system() + platform.release()
            base_key = f"{machine_id}_{system_info}_os_inspector_v2"
            kdf = PBKDF2HMAC(
                algorithm=hashes.SHA256(),
                length=32,
                salt=b'os_inspector_salt',
                iterations=100000,
            )
            key = Fernet.generate_key() if not base_key else base64.urlsafe_b64encode(kdf.derive(base_key.encode()))
            return key
        except:
            return Fernet.generate_key()

    def _create_fernet(self, key):
        try:
            return Fernet(key)
        except:
            return Fernet(Fernet.generate_key())

    def encrypt_password(self, password):
        if not password:
            return ""
        try:
            encrypted = self.fernet.encrypt(str(password).encode('utf-8'))
            return base64.urlsafe_b64encode(encrypted).decode('utf-8')
        except:
            return str(password)

    def decrypt_password(self, encrypted):
        if not encrypted:
            return ""
        try:
            encrypted_bytes = base64.urlsafe_b64decode(str(encrypted).encode('utf-8'))
            return self.fernet.decrypt(encrypted_bytes).decode('utf-8')
        except:
            return str(encrypted)

# ------------------------------------------------------------
# SSH 远程执行器 (优化版：防卡死、详细日志)
# ------------------------------------------------------------
class SSHExecutor:
    def __init__(self, host_info, encryptor):
        self.host_info = host_info
        self.encryptor = encryptor
        self.timeout = 120
        self.logger = logging.getLogger(f"SSH.{host_info.get('host', 'unknown')}")
        self.logger.debug(f"SSHExecutor 初始化: {host_info.get('host')}:{host_info.get('ssh_port', 22)}")

    def execute_command(self, command, timeout=None, retry=1):
        """执行远程命令，优化缓冲区读取防止卡死"""
        if timeout is None:
            timeout = self.timeout

        host = self.host_info['host']
        port = self.host_info.get('ssh_port', 22)
        user = self.host_info.get('ssh_user', 'root')
        
        self.logger.debug(f"[SSH] 准备执行命令 ({host}): {command} (超时: {timeout}s)")

        for attempt in range(retry + 1):
            ssh = None
            try:
                ssh = paramiko.SSHClient()
                ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())

                ssh_password = self.host_info.get('ssh_password', '')
                if ssh_password and self._is_encrypted_format(ssh_password):
                    ssh_password = self.encryptor.decrypt_password(ssh_password)

                self.logger.debug(f"[SSH] 尝试连接 (尝试 {attempt+1}/{retry+1})...")
                
                ssh.connect(
                    hostname=host,
                    port=port,
                    username=user,
                    password=ssh_password,
                    timeout=30,
                    banner_timeout=30,
                    auth_timeout=30,
                    allow_agent=False,
                    look_for_keys=False,
                    compress=True
                )
                
                self.logger.debug(f"[SSH] 连接建立成功")

                # 移除 get_pty=True，避免交互式挂起
                stdin, stdout, stderr = ssh.exec_command(command, timeout=timeout)
                
                # 使用 select 轮询，防止缓冲区满导致死锁
                channel = stdout.channel
                channel.settimeout(timeout)
                
                stdout_data = []
                stderr_data = []
                
                start_time = time.time()
                while not channel.exit_status_ready():
                    if time.time() - start_time > timeout:
                        self.logger.error(f"[SSH] 命令执行超时 ({timeout}s)")
                        raise TimeoutError("Command execution timeout")
                    
                    # 检查 stdout 是否有数据
                    if channel.recv_ready():
                        stdout_data.append(channel.recv(4096).decode('utf-8', errors='ignore'))
                    # 检查 stderr 是否有数据
                    if channel.recv_stderr_ready():
                        stderr_data.append(channel.recv_stderr(4096).decode('utf-8', errors='ignore'))
                    
                    time.sleep(0.1)
                
                # 读取剩余数据
                while channel.recv_ready():
                    stdout_data.append(channel.recv(4096).decode('utf-8', errors='ignore'))
                while channel.recv_stderr_ready():
                    stderr_data.append(channel.recv_stderr(4096).decode('utf-8', errors='ignore'))

                output = ''.join(stdout_data).strip()
                error = ''.join(stderr_data).strip()
                exit_status = channel.recv_exit_status()
                
                self.logger.debug(f"[SSH] 命令执行完毕，退出码: {exit_status}")
                self.logger.debug(f"[SSH] stdout: {output[:300]}")
                if error:
                    self.logger.debug(f"[SSH] stderr: {error[:300]}")

                # 特殊处理 crontab
                if exit_status != 0 and not output:
                    if "no crontab" in error.lower():
                        return ""
                    return f"错误: {error} (退出码: {exit_status})"
                
                ssh.close()
                return output

            except TimeoutError as e:
                self.logger.error(f"[SSH] 超时 (尝试 {attempt+1}/{retry+1}): {e}")
                if attempt == retry:
                    return f"SSH执行失败: 超时 - {e}"
                time.sleep(2)
            except Exception as e:
                self.logger.error(f"[SSH] 执行失败 (尝试 {attempt+1}/{retry+1}): {e}", exc_info=True)
                if attempt == retry:
                    return f"SSH执行失败: {e}"
                time.sleep(2)
            finally:
                if ssh:
                    try:
                        ssh.close()
                    except:
                        pass

        return "SSH执行失败: 未知错误"

    def _is_encrypted_format(self, password):
        try:
            return len(str(password)) > 50 and re.match(r'^[A-Za-z0-9-_]*={0,2}$', str(password))
        except:
            return False

# ------------------------------------------------------------
# 控制台美化输出
# ------------------------------------------------------------
class ConsolePrinter:
    @staticmethod
    def separator():
        print("=" * 60)

    @staticmethod
    def title(title):
        ConsolePrinter.separator()
        print(f"🎯 {title}")
        ConsolePrinter.separator()

    @staticmethod
    def success(msg):
        print(f"✅ {msg}")

    @staticmethod
    def info(msg):
        print(f"ℹ️  {msg}")

    @staticmethod
    def warning(msg):
        print(f"⚠️  {msg}")

    @staticmethod
    def error(msg):
        print(f"❌ {msg}")

# ------------------------------------------------------------
# 操作系统巡检核心类 (含深度中间件检查)
# ------------------------------------------------------------
class OSSysChecker:
    def __init__(self, host_info=None, encryptor=None):
        self.host_info = host_info
        self.encryptor = encryptor
        self.is_local = host_info is None
        self.ssh_executor = None
        if not self.is_local:
            self.ssh_executor = SSHExecutor(host_info, encryptor)
        self.results = {}
        self._collect_basic_info()

    def _execute(self, command, timeout=None):
        """统一执行命令入口，支持自定义超时"""
        logger.debug(f"[Check] 执行检查命令: {command}")
        if self.is_local:
            # 本地执行：如果指定了timeout就用指定的，否则用默认30s
            t = timeout if timeout else 30
            out, _, rc = run_local_cmd(command, timeout=t)
            if rc != 0 or is_error_output(out):
                return ""
            return out
        else:
            # 远程执行：传入timeout
            out = self.ssh_executor.execute_command(command, timeout=timeout, retry=1)
            if is_error_output(out):
                return ""
            return out

    def _collect_basic_info(self):
        self.hostname = self._get_hostname()
        self.os_info = self._get_os_info()
        self.kernel = self._get_kernel()
        self.cpu_cores = self._get_cpu_cores()
        self.mem_total = self._get_mem_total()
        self.ip_address = self.host_info['host'] if self.host_info else self._get_ip_address()
        self.uptime = self._get_uptime()

    def _get_hostname(self):
        out = self._execute("hostname")
        return out.strip() if out else (self.host_info['host'] if self.host_info else platform.node())

    def _get_os_info(self):
        out = self._execute("cat /etc/os-release | grep PRETTY_NAME | cut -d= -f2 | tr -d '\"'")
        if out:
            return out.strip()
        return self._execute("uname -sr") or "未知"

    def _get_kernel(self):
        out = self._execute("uname -r")
        return out.strip() or platform.release()

    def _get_cpu_cores(self):
        out = self._execute("grep -c ^processor /proc/cpuinfo")
        return safe_int(out, os.cpu_count() or 0)

    def _get_mem_total(self):
        out = self._execute("grep MemTotal /proc/meminfo | awk '{print $2}'")
        mem_kb = safe_int(out)
        if mem_kb > 0:
            return f"{mem_kb // 1024} MB" if mem_kb < 1048576 else f"{mem_kb // 1048576} GB"
        return "未知"

    def _get_ip_address(self):
        out = self._execute("hostname -I | awk '{print $1}'")
        if out:
            return out.strip()
        out = self._execute("ip -4 addr show | grep -oP '(?<=inet\\s)\\d+(\\.\\d+){3}' | grep -v '127.0.0.1' | head -1")
        return out.strip() or "未知"

    def _get_uptime(self):
        out = self._execute("uptime -p")
        if out:
            return out.replace('up ', '').strip()
        out = self._execute("cat /proc/uptime | awk '{print int($1/86400)\"天 \"int(($1%86400)/3600)\"小时\"}'")
        return out.strip() or "未知"

    # ---------- 1. 系统基本信息 ----------
    def check_system_basic(self):
        data = [
            ["系统版本", self.os_info, "正常"],
            ["内核版本", self.kernel, "正常"],
            ["主机名", self.hostname, "已配置"],
            ["IP地址", self.ip_address, "已分配"],
            ["运行时间", self.uptime, "稳定"],
            ["CPU核心", f"{self.cpu_cores} 核心", "已识别"],
            ["总内存", self.mem_total, "已识别"]
        ]
        self.results["系统基本信息"] = {"columns": ["属性", "值", "状态"], "data": data}
        return data

    # ---------- 2. 环境安全检查 ----------
    def check_env_security(self):
        path_env = self._execute("echo $PATH")
        paths = path_env.split(':')
        dangerous_paths = ["/", "/root", "/tmp", "/var/tmp", "/dev/shm"]
        dangerous_found = []
        writable_paths = []
        # 优化：不再对每个PATH都执行test，减少命令执行次数
        for p in paths[:10]:  # 只检查前10个PATH，避免过多
            if p in dangerous_paths:
                dangerous_found.append(p)
            if p:
                if self.is_local:
                    if os.path.isdir(p) and os.access(p, os.W_OK):
                        writable_paths.append(p)
                else:
                    # 远程检查合并为一条命令
                    pass 
        
        # 远程PATH检查优化：批量检查
        if not self.is_local and paths:
            # 构造一个批量检查脚本
            cmd = "for p in " + ":".join(paths[:10]).replace(':', ' ') + "; do test -d $p -a -w $p && echo $p; done"
            out = self._execute(cmd, timeout=10)
            if out:
                writable_paths = out.split('\n')

        path_data = []
        if dangerous_found:
            path_data.append(["PATH危险路径", ", ".join(dangerous_found[:5]), "危险"])
        if writable_paths:
            path_data.append(["PATH可写路径", ", ".join(writable_paths[:5]), "警告"])
        if not dangerous_found and not writable_paths:
            path_data.append(["PATH环境变量", "检查正常", "正常"])

        env_out = self._execute("env")
        sensitive_keywords = ["PASSWORD", "SECRET", "KEY", "TOKEN", "CREDENTIAL", "PASS", "DB_PASS"]
        sensitive_vars = []
        for line in env_out.split('\n'):
            for kw in sensitive_keywords:
                if kw in line.upper():
                    var = line.split('=')[0]
                    sensitive_vars.append(f"{var}=****")
                    break
        sensitive_data = []
        if sensitive_vars:
            sensitive_data.append(["敏感变量", "; ".join(sensitive_vars[:5]), "警告"])
        else:
            sensitive_data.append(["敏感环境变量", "未发现", "正常"])

        env_files = ["/etc/profile", "/etc/bashrc", "~/.bashrc", "~/.bash_profile"]
        file_perm_data = []
        for f in env_files:
            if self.is_local:
                path = os.path.expanduser(f)
                if os.path.exists(path):
                    stat = os.stat(path)
                    perms = oct(stat.st_mode)[-3:]
                    status = "安全权限" if int(perms) <= 644 else "不安全权限"
                else:
                    perms, status = "不存在", "信息"
            else:
                stat_cmd = f"stat -c '%a' {f} 2>/dev/null || echo '不存在'"
                perms = self._execute(stat_cmd)
                if perms and perms != '不存在' and perms.isdigit():
                    status = "安全权限" if int(perms) <= 644 else "不安全权限"
                else:
                    perms, status = "不存在", "信息"
            file_perm_data.append([f, perms, status])

        self.results["环境变量安全检测"] = {"columns": ["检查项", "详情", "状态"], "data": path_data + sensitive_data}
        self.results["环境配置文件权限"] = {"columns": ["文件", "权限", "状态"], "data": file_perm_data}

    # ---------- 3. 僵尸进程检测 ----------
    def check_zombie_processes(self):
        out = self._execute("ps aux | awk '$8==\"Z\"'")
        zombies = []
        for line in out.strip().split('\n'):
            if line and 'awk' not in line and 'Z' in line:
                parts = line.split()
                if len(parts) >= 11:
                    pid = parts[1]
                    cmd = parts[10]
                    zombies.append([pid, cmd[:40]])
        self.results["僵尸进程"] = {
            "columns": ["PID", "命令"],
            "data": zombies if zombies else [["无", "未发现僵尸进程"]]
        }

    # ---------- 4. 系统句柄分析 ----------
    def check_file_handles(self):
        sys_max = "未知"
        sys_current = "未知"
        sys_available = "未知"
        usage_rate = 0.0
        try:
            if self.is_local:
                with open('/proc/sys/fs/file-max', 'r') as f:
                    sys_max = int(f.read().strip())
                with open('/proc/sys/fs/file-nr', 'r') as f:
                    parts = f.read().split()
                    sys_current = int(parts[0])
            else:
                max_out = self._execute("cat /proc/sys/fs/file-max")
                if max_out and max_out.isdigit():
                    sys_max = int(max_out)
                nr_out = self._execute("cat /proc/sys/fs/file-nr")
                if nr_out:
                    parts = nr_out.strip().split()
                    if parts and parts[0].isdigit():
                        sys_current = int(parts[0])
            if isinstance(sys_max, int) and isinstance(sys_current, int) and sys_max > 0:
                sys_available = sys_max - sys_current
                usage_rate = round((sys_current / sys_max) * 100, 2)
        except:
            pass

        soft_limit = self._execute("ulimit -Sn") or "未知"
        hard_limit = self._execute("ulimit -Hn") or "未知"

        if usage_rate > 80:
            usage_status = "危险"
        elif usage_rate > 60:
            usage_status = "警告"
        else:
            usage_status = "正常"

        handle_summary = [
            ["系统级最大句柄数", sys_max, "已配置"],
            ["当前已使用句柄", sys_current, "正常"],
            ["句柄剩余可用", sys_available, "充足"],
            ["用户级软限制", soft_limit, "已设置"],
            ["用户级硬限制", hard_limit, "已设置"],
            ["句柄使用率", f"{usage_rate}%", usage_status]
        ]
        self.results["系统句柄数分析"] = {"columns": ["项目", "值", "状态"], "data": handle_summary}

        lsof_installed = self._execute("command -v lsof") != ""
        process_handles = []
        if lsof_installed:
            # 优化：lsof 非常慢，这里限制超时
            out = self._execute("lsof -n 2>/dev/null | awk '{print $2}' | sort | uniq -c | sort -nr | head -10", timeout=20)
            if out:
                for line in out.strip().split('\n'):
                    parts = line.strip().split()
                    if len(parts) >= 2:
                        count = parts[0]
                        pid = parts[1]
                        # 优化：不再循环调用 ps -p，而是一次性获取
                        proc_name = "未知" 
                        count_val = safe_int(count)
                        if count_val > 1000:
                            status = "过高"
                        elif count_val > 500:
                            status = "偏多"
                        else:
                            status = "正常"
                        process_handles.append([pid, count_val, proc_name[:30], status])
            else:
                process_handles.append(["lsof执行超时/失败", "", "跳过进程句柄统计", "信息"])
        else:
            process_handles.append(["lsof未安装", "", "无法获取进程句柄信息", "警告"])
        self.results["进程句柄TOP10"] = {
            "columns": ["PID", "句柄数", "进程名", "状态"],
            "data": process_handles
        }

    # ---------- 5. 磁盘 I/O 统计 ----------
    def check_disk_io(self):
        content = self._execute("cat /proc/diskstats")
        disk_data = []
        if content:
            for line in content.strip().split('\n')[:10]:
                parts = line.split()
                if len(parts) >= 14:
                    dev = parts[2]
                    rd_ios = parts[3]
                    wr_ios = parts[7]
                    total = safe_int(rd_ios) + safe_int(wr_ios)
                    disk_data.append([dev, rd_ios, wr_ios, total])
        self.results["磁盘I/O统计"] = {
            "columns": ["设备", "读完成", "写完成", "总I/O次数"],
            "data": disk_data if disk_data else [["无", "无法获取/proc/diskstats", "", ""]]
        }

    # ---------- 6. 深度中间件巡检 ----------
    def check_middleware_detailled(self):
        """深度中间件检查：Nginx, Redis, Kafka, ES, Tomcat, 各类数据库"""
        middleware_results = []
        
        # 1. Nginx
        logger.debug("[中间件] 检查 Nginx...")
        nginx_ps = self._execute("ps aux | grep nginx | grep -v grep || true")
        if nginx_ps:
            version = self._execute("nginx -v 2>&1 || true", timeout=10)
            middleware_results.append(["Nginx", "运行中", version[:50], "Web服务"])
        
        # 2. Redis
        logger.debug("[中间件] 检查 Redis...")
        redis_ps = self._execute("ps aux | grep redis-server | grep -v grep || true")
        if redis_ps:
            version = self._execute("redis-cli --version || true", timeout=10)
            middleware_results.append(["Redis", "运行中", version[:50], "缓存"])
        
        # 3. Kafka
        logger.debug("[中间件] 检查 Kafka...")
        kafka_ps = self._execute("ps aux | grep kafka.Kafka | grep -v grep || true")
        if kafka_ps:
            middleware_results.append(["Kafka", "运行中", "JVM进程", "消息队列"])
        
        # 4. Elasticsearch
        logger.debug("[中间件] 检查 Elasticsearch...")
        es_ps = self._execute("ps aux | grep elasticsearch | grep -v grep || true")
        if es_ps:
            middleware_results.append(["Elasticsearch", "运行中", "Java进程", "搜索引擎"])
        
        # 5. Tomcat
        logger.debug("[中间件] 检查 Tomcat...")
        tomcat_ps = self._execute("ps aux | grep -E 'catalina|tomcat' | grep -v grep || true")
        if tomcat_ps:
            middleware_results.append(["Tomcat", "运行中", "Java容器", "Web中间件"])
        
        # 6. MySQL
        logger.debug("[中间件] 检查 MySQL...")
        mysql_ps = self._execute("ps aux | grep mysqld | grep -v grep || true")
        if mysql_ps:
            # 移除可能卡住的 mysql --version 检查
            middleware_results.append(["MySQL", "运行中", "进程存在", "数据库"])
        
        # 7. Oracle (简单检查)
        oracle_ps = self._execute("ps aux | grep ora_pmon | grep -v grep || true")
        if oracle_ps:
            middleware_results.append(["Oracle", "运行中", "PMON进程存在", "数据库"])
        
        # 8. 达梦数据库
        dmserver_ps = self._execute("ps aux | grep dmserver | grep -v grep || true")
        if dmserver_ps:
            middleware_results.append(["达梦数据库", "运行中", "dmserver进程", "国产数据库"])

        if middleware_results:
            self.results["深度中间件巡检"] = {
                "columns": ["中间件", "状态", "版本/信息", "备注"],
                "data": middleware_results
            }
        else:
            self.results["深度中间件巡检"] = {
                "columns": ["提示"],
                "data": [["未在标准路径/进程中发现常见中间件"]]
            }

    # ---------- 7. 基础端口探测 ----------
    def check_middleware(self):
        out = self._execute("ss -tlnp 2>/dev/null")
        if not out:
            self.results["中间件端口状态"] = {"columns": ["错误"], "data": [["无法获取监听端口信息"]]}
            return
        middleware_map = {
            '3306': 'MySQL', '6379': 'Redis', '27017': 'MongoDB',
            '5432': 'PostgreSQL', '1521': 'Oracle', '5236': '达梦',
            '80': 'HTTP', '443': 'HTTPS', '8080': 'Tomcat',
            '2181': 'ZooKeeper', '9092': 'Kafka', '5672': 'RabbitMQ',
            '15672': 'RabbitMQ管理', '9200': 'Elasticsearch',
            '5601': 'Kibana', '9300': 'Elasticsearch', '8848': 'Nacos'
        }
        results = []
        for line in out.split('\n'):
            parts = line.strip().split()
            if len(parts) >= 5:
                proto = parts[0]
                addr = parts[3]
                port_part = addr.split(':')[-1]
                if port_part.isdigit():
                    port = port_part
                    service = middleware_map.get(port, '未知')
                    proc = parts[-1] if 'users:' in line else ''
                    proc_name = ''
                    if 'pid=' in proc:
                        m = re.search(r'pid=(\d+),.*?process="?([^",]+)', proc)
                        if m:
                            proc_name = m.group(2)
                    if service != '未知' or (service == '未知' and proc_name):
                        results.append([port, service, proc_name, proto, '监听中'])
        if results:
            self.results["中间件端口状态"] = {
                "columns": ["端口", "服务", "进程", "协议", "状态"],
                "data": results
            }
        else:
            self.results["中间件端口状态"] = {"columns": ["信息"], "data": [["未发现常见中间件端口"]]}

    # ---------- 8. CPU性能 ----------
    def check_performance(self):
        cpu_model = "未知"
        out = self._execute("grep -m1 'model name' /proc/cpuinfo | cut -d: -f2 | sed -e 's/^ *//'")
        if out:
            cpu_model = out.strip()

        cpu_usage = 0.0
        # 优化：vmstat 1 2 需要2秒，改为读取 /proc/stat 计算 (虽然复杂但快)，或者保留但接受
        vmstat_ok = self._execute("command -v vmstat") != ""
        if vmstat_ok:
            # 注意：vmstat 1 2 必须等2秒，这是无法避免的，但为了性能可以接受
            out = self._execute("vmstat 1 2", timeout=5) 
            lines = out.strip().split('\n')
            if len(lines) >= 3:
                parts = lines[-1].split()
                if len(parts) >= 15:
                    idle = safe_int(parts[14])
                    cpu_usage = round(100 - idle, 2)
        if cpu_usage > 80:
            cpu_status = "过高"
        elif cpu_usage > 60:
            cpu_status = "中等"
        else:
            cpu_status = "正常"

        cpu_top = []
        out = self._execute("ps -eo %cpu,pid,user,comm --sort=-%cpu | head -6")
        if out:
            for line in out.strip().split('\n')[1:]:
                parts = line.strip().split(maxsplit=3)
                if len(parts) >= 4:
                    cpu = parts[0]
                    pid = parts[1]
                    user = parts[2]
                    cmd = parts[3]
                    try:
                        cpu_val = float(cpu)
                        if cpu_val > 20:
                            status = "过高"
                        elif cpu_val > 10:
                            status = "偏大"
                        else:
                            status = "正常"
                    except:
                        status = "未知"
                    cpu_top.append([f"{cpu}%", pid, user, cmd[:30], status])

        mem_total = "未知"
        mem_used = "未知"
        mem_free = "未知"
        mem_available = "未知"
        mem_used_percent = 0.0
        out = self._execute("free -h")
        if out:
            for line in out.strip().split('\n'):
                if line.startswith('Mem:'):
                    parts = line.split()
                    if len(parts) >= 7:
                        mem_total = parts[1]
                        mem_used = parts[2]
                        mem_free = parts[3]
                        mem_available = parts[6]
        out = self._execute("free | grep Mem | awk '{printf \"%.2f\", $3/$2*100}'")
        if out:
            try:
                mem_used_percent = float(out)
            except:
                pass
        if mem_used_percent > 80:
            mem_status = "过高"
        elif mem_used_percent > 60:
            mem_status = "中等"
        else:
            mem_status = "正常"

        mem_top = []
        out = self._execute("ps -eo %mem,rss,pid,user,comm --sort=-%mem | head -6")
        if out:
            for line in out.strip().split('\n')[1:]:
                parts = line.strip().split(maxsplit=4)
                if len(parts) >= 5:
                    mem_per = parts[0]
                    rss_kb = parts[1]
                    pid = parts[2]
                    user = parts[3]
                    cmd = parts[4]
                    try:
                        mem_val = float(mem_per)
                        if mem_val > 10:
                            status = "过高"
                        elif mem_val > 5:
                            status = "偏大"
                        else:
                            status = "正常"
                    except:
                        status = "未知"
                    mem_top.append([f"{mem_per}%", f"{rss_kb}K", pid, user, cmd[:30], status])

        disk_usage = []
        out = self._execute("df -h | grep -vE 'tmpfs|loop|udev'")
        if out:
            for line in out.strip().split('\n')[1:]:
                parts = line.split()
                if len(parts) >= 6:
                    fs = parts[0]
                    size = parts[1]
                    used = parts[2]
                    avail = parts[3]
                    use_per = parts[4]
                    mount = parts[5]
                    try:
                        use_val = int(use_per.strip('%'))
                        if use_val > 80:
                            status = "危险"
                        elif use_val > 60:
                            status = "警告"
                        else:
                            status = "正常"
                    except:
                        status = "未知"
                    disk_usage.append([fs, size, used, avail, use_per, mount, status])

        self.results["CPU性能"] = {
            "columns": ["项目", "值", "状态"],
            "data": [
                ["CPU型号", cpu_model, "已识别"],
                ["CPU核心", f"{self.cpu_cores} 核心", "已配置"],
                ["CPU使用率", f"{cpu_usage}%", cpu_status]
            ]
        }
        self.results["CPU占用TOP5"] = {"columns": ["CPU%", "PID", "用户", "命令", "状态"], "data": cpu_top}
        self.results["内存性能"] = {
            "columns": ["项目", "值", "状态"],
            "data": [
                ["总内存", mem_total, "已识别"],
                ["已使用", f"{mem_used} ({mem_used_percent}%)", mem_status],
                ["空闲内存", mem_free, "可用"],
                ["可用内存", mem_available, "可分配"]
            ]
        }
        self.results["内存占用TOP5"] = {
            "columns": ["内存%", "内存大小", "PID", "用户", "命令", "状态"],
            "data": mem_top
        }
        self.results["磁盘使用率"] = {
            "columns": ["文件系统", "大小", "已用", "可用", "使用%", "挂载点", "状态"],
            "data": disk_usage
        }

    # ---------- 9. 服务与系统更新 (核心优化区) ----------
    def check_services_updates(self):
        critical_services = ["sshd", "firewalld", "crond", "rsyslog", "docker", "nginx", "mysql", "redis"]
        services_status = []
        has_systemctl = self._execute("command -v systemctl") != ""

        for svc in critical_services:
            if has_systemctl:
                # 优化：使用 is-active 并加上短超时
                out = self._execute(f"systemctl is-active --quiet {svc}", timeout=5)
                if out == "":
                    services_status.append([svc, "正常运行", "正常"])
                else:
                    # 不再检查是否 installed，减少命令
                    services_status.append([svc, "未运行/未安装", "信息"])
            else:
                out = self._execute(f"service {svc} status", timeout=5)
                if "running" in out:
                    services_status.append([svc, "正常运行", "正常"])
                else:
                    services_status.append([svc, "未知状态", "警告"])

        # 【核心修复】系统更新检查优化
        updates_info = []
        if self._execute("command -v apt", timeout=5) != "":
            # 简单检查：不实际 update，只检查是否有 apt
            updates_info = [["apt", "检查跳过", "检查跳过", "为避免卡顿已跳过"]]
        elif self._execute("command -v yum", timeout=5) != "":
            # 【核心修复】移除 yum check-update -q，改为仅检查 yum 可用性
            # 因为 yum check-update 极易造成卡死
            updates_info = [["yum", "检查跳过", "检查跳过", "为避免卡顿已跳过"]]
        else:
            updates_info = [["未知包管理器", 0, 0, "无法检测"]]

        self.results["关键服务状态"] = {"columns": ["服务", "状态", "评估"], "data": services_status}
        self.results["系统更新检查"] = {"columns": ["包管理器", "可用更新", "安全更新", "状态"], "data": updates_info}

    # ---------- 10. 日志与定时任务 ----------
    def check_logs_cron(self):
        error_logs = []
        log_files = ["/var/log/messages", "/var/log/syslog"]
        for logf in log_files:
            # 优化：grep 加上超时
            out = self._execute(f"grep -iE 'error|fail|critical|alert|emergency' {logf} 2>/dev/null | grep -v 'CRON' | tail -5", timeout=10)
            if out:
                for line in out.strip().split('\n')[:5]:
                    if line:
                        error_logs.append([logf, clean_string(line[:100])])

        login_fails = []
        auth_files = ["/var/log/secure", "/var/log/auth.log"]
        for af in auth_files:
            out = self._execute(f"grep 'Failed password' {af} 2>/dev/null | tail -5", timeout=10)
            if out:
                for line in out.strip().split('\n')[:5]:
                    if line:
                        login_fails.append([af, clean_string(line[:100])])

        cron_tasks = []
        out = self._execute("cat /etc/crontab 2>/dev/null")
        if out:
            valid_lines = []
            for line in out.strip().split('\n'):
                line = line.strip()
                if not line or line.startswith('#'):
                    continue
                if line.startswith('SHELL=') or line.startswith('PATH=') or line.startswith('MAILTO='):
                    continue
                valid_lines.append(line)
            if valid_lines:
                cron_tasks.append(["系统crontab", "\n".join(valid_lines)[:200]])

        # 优化：只检查 root 用户的 crontab，不再遍历前5个用户，减少 SSH 交互
        out = self._execute("crontab -l -u root 2>/dev/null")
        if out and "no crontab" not in out.lower():
            valid_lines = []
            for line in out.strip().split('\n'):
                line = line.strip()
                if line and not line.startswith('#'):
                    valid_lines.append(line)
            if valid_lines:
                cron_tasks.append([f"用户 root", "\n".join(valid_lines)[:150]])

        suspicious = []
        # 优化：可疑任务检查加上超时
        out = self._execute("grep -r -E 'wget|curl|bash -i|nc |netcat' /etc/cron* 2>/dev/null | grep -v -E '#|/usr/bin/' | head -5", timeout=15)
        if out:
            suspicious = out.strip().split('\n')[:5]

        self.results["错误日志"] = {
            "columns": ["日志文件", "最新错误(前5条)"],
            "data": error_logs if error_logs else [["无", "未发现明显错误日志"]]
        }
        self.results["登录失败记录"] = {
            "columns": ["认证文件", "失败记录(前5条)"],
            "data": login_fails if login_fails else [["无", "未发现登录失败记录"]]
        }
        self.results["定时任务摘要"] = {
            "columns": ["类型", "内容(部分)"],
            "data": cron_tasks if cron_tasks else [["无", "无定时任务"]]
        }
        self.results["可疑定时任务"] = {
            "columns": ["发现位置"],
            "data": [[s] for s in suspicious] if suspicious else [["未发现可疑定时任务"]]
        }

    # ---------- 11. 网络状态 ----------
    def check_network(self):
        interfaces = []
        out = self._execute("ip addr show | grep -E '^[0-9]+:|inet ' | grep -v '127.0.0.1' | head -10")
        if out:
            interfaces = out.strip().split('\n')

        conn_status = []
        out = self._execute("ss -ant | awk 'NR>1 {++S[$1]} END {for(a in S) print a, S[a]}'")
        if out:
            for line in out.strip().split('\n'):
                parts = line.split()
                if len(parts) >= 2:
                    conn_status.append([parts[0], parts[1], "TCP连接"])
        else:
            conn_status.append(["ss命令不可用", "", "无法获取连接状态"])

        listen_ports = []
        out = self._execute("ss -tuln | awk 'NR>1 {print $1, $5, $7}'")
        if out:
            for line in out.strip().split('\n')[:10]:
                parts = line.strip().split()
                if len(parts) >= 2:
                    proto = parts[0]
                    port = parts[1].split(':')[-1]
                    program = parts[2] if len(parts) > 2 else ""
                    listen_ports.append([proto, port, program, "监听中"])
        else:
            listen_ports.append(["ss未安装", "", "", "无法获取端口信息"])

        self.results["网络接口信息"] = {"columns": ["接口配置"], "data": [[line] for line in interfaces] if interfaces else [["无有效接口信息"]]}
        self.results["网络连接状态"] = {"columns": ["状态", "连接数", "说明"], "data": conn_status}
        self.results["监听端口"] = {"columns": ["协议", "端口", "程序", "状态"], "data": listen_ports}

    # ---------- 运行所有检查 ----------
    def run_all(self):
        logger.info(f"开始对 {self.hostname} ({self.ip_address}) 进行全量巡检...")
        self.check_system_basic()
        self.check_env_security()
        self.check_zombie_processes()
        self.check_file_handles()
        self.check_disk_io()
        self.check_middleware()           # 基础端口
        self.check_middleware_detailled() # 深度检查
        self.check_performance()
        self.check_services_updates()     # (已优化)
        self.check_logs_cron()
        self.check_network()
        logger.info(f"巡检完成: {self.hostname}")
        return self.results

# ------------------------------------------------------------
# Word 报告生成器
# ------------------------------------------------------------
class OSReportGenerator:
    def __init__(self, results, hostname=None, output_path=None,
                 operation_unit="中国移动", operator="陈松坡"):
        self.results = results
        self.hostname = hostname or self._extract_hostname()
        self.output_path = output_path
        self.operation_unit = operation_unit
        self.operator = operator
        self.doc = None

    def _extract_hostname(self):
        basic = self.results.get("系统基本信息", {}).get("data", [])
        for row in basic:
            if row[0] == "主机名":
                return row[1]
        return platform.node()

    def _set_font(self, run, size=12, bold=False, color=None, font_name='微软雅黑'):
        run.font.name = font_name
        run._element.rPr.rFonts.set(qn('w:eastAsia'), font_name)
        run.font.size = Pt(size)
        run.font.bold = bold
        if color:
            run.font.color.rgb = color

    def _add_heading(self, text, level=1):
        heading = self.doc.add_heading('', level)
        run = heading.add_run(text)
        self._set_font(run, size=16 if level == 1 else 14, bold=True, color=RGBColor(0, 0, 128))
        return heading

    def _add_table(self, columns, data, col_widths=None):
        if not data:
            return
        table = self.doc.add_table(rows=len(data)+1, cols=len(columns))
        table.style = 'Light Grid Accent 1'
        for col_idx, col_name in enumerate(columns):
            cell = table.cell(0, col_idx)
            cell.text = clean_string(col_name)
            for p in cell.paragraphs:
                for r in p.runs:
                    self._set_font(r, size=11, bold=True)
        for row_idx, row_data in enumerate(data):
            for col_idx, cell_value in enumerate(row_data):
                if col_idx < len(columns):
                    cell = table.cell(row_idx+1, col_idx)
                    cell.text = clean_string(str(cell_value))
                    if columns[col_idx].lower() in ['状态', '评估']:
                        text_lower = str(cell_value).lower()
                        for p in cell.paragraphs:
                            for r in p.runs:
                                if any(k in text_lower for k in ['正常', '成功', '已是最新', '已分配', '已配置', '稳定', '运行中']):
                                    r.font.color.rgb = RGBColor(0, 128, 0)
                                elif any(k in text_lower for k in ['警告', '偏多', '中等', '偏大', '跳过']):
                                    r.font.color.rgb = RGBColor(255, 165, 0)
                                elif any(k in text_lower for k in ['危险', '过高', '错误', '失败']):
                                    r.font.color.rgb = RGBColor(255, 0, 0)
        if col_widths:
            for i, w in enumerate(col_widths):
                if i < len(table.columns):
                    for cell in table.columns[i].cells:
                        cell.width = w
        return table

    def _add_progress(self, percentage, label="使用率"):
        p = self.doc.add_paragraph()
        p.add_run(f"{label}: {percentage}% ").font.bold = True
        filled = int(percentage / 100 * 20)
        bar = "█" * filled + "▒" * (20 - filled)
        run = p.add_run(bar)
        if percentage > 80:
            run.font.color.rgb = RGBColor(255, 0, 0)
        elif percentage > 60:
            run.font.color.rgb = RGBColor(255, 165, 0)
        else:
            run.font.color.rgb = RGBColor(0, 128, 0)
        p.add_run(f" {percentage}%")

    def generate(self):
        if not HAS_DOCX:
            ConsolePrinter.error("python-docx 未安装，无法生成Word报告")
            return None

        self.doc = docx.Document()
        style = self.doc.styles['Normal']
        style.font.name = '微软雅黑'
        style._element.rPr.rFonts.set(qn('w:eastAsia'), '微软雅黑')

        # 封面
        title = self.doc.add_heading('', 0)
        title.alignment = WD_ALIGN_PARAGRAPH.CENTER
        run = title.add_run('操作系统批量巡检报告')
        self._set_font(run, size=24, bold=True, color=RGBColor(0, 0, 128))

        self.doc.add_paragraph()
        info_p = self.doc.add_paragraph()
        info_p.alignment = WD_ALIGN_PARAGRAPH.CENTER
        run = info_p.add_run(f"主机: {self.hostname}  |  巡检时间: {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}")
        self._set_font(run, size=12)
        self.doc.add_page_break()

        # 1. 巡检概览
        self._add_heading('1. 巡检概览', level=1)
        basic = self.results.get("系统基本信息", {}).get("data", [])
        overview_data = []
        for row in basic[:4]:
            overview_data.append([row[0], row[1]])
        overview_data.append(["巡检时间", datetime.now().strftime('%Y-%m-%d %H:%M:%S')])
        overview_data.append(["运维单位", self.operation_unit])
        overview_data.append(["运维人员", self.operator])
        overview_data.append(["报告生成", f"{self.operator}@{self.hostname}"])
        table = self.doc.add_table(rows=len(overview_data), cols=2)
        table.style = 'Light Grid Accent 1'
        for i, (label, value) in enumerate(overview_data):
            table.cell(i, 0).text = clean_string(label)
            table.cell(i, 1).text = clean_string(value)
            table.cell(i, 0).paragraphs[0].runs[0].font.bold = True

        # 2. 系统基本信息
        self._add_heading('2. 系统基本信息', level=1)
        if "系统基本信息" in self.results:
            self._add_table(
                self.results["系统基本信息"]["columns"],
                self.results["系统基本信息"]["data"]
            )

        # 3. 安全检查
        self._add_heading('3. 安全检查', level=1)
        if "环境变量安全检测" in self.results:
            self._add_heading('3.1 PATH与敏感变量', level=2)
            self._add_table(
                self.results["环境变量安全检测"]["columns"],
                self.results["环境变量安全检测"]["data"]
            )
        if "环境配置文件权限" in self.results:
            self._add_heading('3.2 环境配置文件权限', level=2)
            self._add_table(
                self.results["环境配置文件权限"]["columns"],
                self.results["环境配置文件权限"]["data"]
            )

        # 4. 僵尸进程
        self._add_heading('4. 僵尸进程', level=1)
        if "僵尸进程" in self.results:
            self._add_table(
                self.results["僵尸进程"]["columns"],
                self.results["僵尸进程"]["data"]
            )

        # 5. 系统句柄分析
        self._add_heading('5. 系统句柄分析', level=1)
        if "系统句柄数分析" in self.results:
            self._add_table(
                self.results["系统句柄数分析"]["columns"],
                self.results["系统句柄数分析"]["data"]
            )
            for row in self.results["系统句柄数分析"]["data"]:
                if "句柄使用率" in row[0]:
                    try:
                        percent = float(row[1].strip('%'))
                        self._add_progress(percent, "系统句柄使用率")
                    except:
                        pass
        if "进程句柄TOP10" in self.results:
            self._add_heading('5.1 句柄使用TOP10进程', level=2)
            self._add_table(
                self.results["进程句柄TOP10"]["columns"],
                self.results["进程句柄TOP10"]["data"]
            )

        # 6. 磁盘I/O
        self._add_heading('6. 磁盘I/O统计', level=1)
        if "磁盘I/O统计" in self.results:
            self._add_table(
                self.results["磁盘I/O统计"]["columns"],
                self.results["磁盘I/O统计"]["data"]
            )

        # 7. 中间件
        self._add_heading('7. 中间件巡检', level=1)
        if "中间件端口状态" in self.results:
            self._add_heading('7.1 端口监听概览', level=2)
            self._add_table(
                self.results["中间件端口状态"]["columns"],
                self.results["中间件端口状态"]["data"]
            )
        if "深度中间件巡检" in self.results:
            self._add_heading('7.2 深度状态检查', level=2)
            self._add_table(
                self.results["深度中间件巡检"]["columns"],
                self.results["深度中间件巡检"]["data"]
            )

        # 8. 性能分析
        self._add_heading('8. 性能分析', level=1)
        if "CPU性能" in self.results:
            self._add_heading('8.1 CPU性能', level=2)
            self._add_table(
                self.results["CPU性能"]["columns"],
                self.results["CPU性能"]["data"]
            )
            for row in self.results["CPU性能"]["data"]:
                if "CPU使用率" in row[0]:
                    try:
                        percent = float(row[1].strip('%'))
                        self._add_progress(percent, "CPU使用率")
                    except:
                        pass
        if "CPU占用TOP5" in self.results:
            self._add_heading('8.2 CPU占用TOP5进程', level=2)
            self._add_table(
                self.results["CPU占用TOP5"]["columns"],
                self.results["CPU占用TOP5"]["data"]
            )
        if "内存性能" in self.results:
            self._add_heading('8.3 内存性能', level=2)
            self._add_table(
                self.results["内存性能"]["columns"],
                self.results["内存性能"]["data"]
            )
            for row in self.results["内存性能"]["data"]:
                if "已使用" in row[0]:
                    m = re.search(r'\((\d+\.?\d*)%\)', row[1])
                    if m:
                        percent = float(m.group(1))
                        self._add_progress(percent, "内存使用率")
        if "内存占用TOP5" in self.results:
            self._add_heading('8.4 内存占用TOP5进程', level=2)
            self._add_table(
                self.results["内存占用TOP5"]["columns"],
                self.results["内存占用TOP5"]["data"]
            )
        if "磁盘使用率" in self.results:
            self._add_heading('8.5 磁盘使用率', level=2)
            self._add_table(
                self.results["磁盘使用率"]["columns"],
                self.results["磁盘使用率"]["data"],
                col_widths=[Cm(3), Cm(2), Cm(2), Cm(2), Cm(1.5), Cm(3), Cm(2)]
            )

        # 9. 服务与系统更新
        self._add_heading('9. 服务与系统更新', level=1)
        if "关键服务状态" in self.results:
            self._add_heading('9.1 关键服务状态', level=2)
            self._add_table(
                self.results["关键服务状态"]["columns"],
                self.results["关键服务状态"]["data"]
            )
        if "系统更新检查" in self.results:
            self._add_heading('9.2 系统更新', level=2)
            self._add_table(
                self.results["系统更新检查"]["columns"],
                self.results["系统更新检查"]["data"]
            )

        # 10. 日志与定时任务
        self._add_heading('10. 日志与定时任务', level=1)
        if "错误日志" in self.results:
            self._add_heading('10.1 系统错误日志', level=2)
            self._add_table(
                self.results["错误日志"]["columns"],
                self.results["错误日志"]["data"],
                col_widths=[Cm(4), Cm(12)]
            )
        if "登录失败记录" in self.results:
            self._add_heading('10.2 登录失败记录', level=2)
            self._add_table(
                self.results["登录失败记录"]["columns"],
                self.results["登录失败记录"]["data"],
                col_widths=[Cm(4), Cm(12)]
            )
        if "定时任务摘要" in self.results:
            self._add_heading('10.3 定时任务摘要', level=2)
            self._add_table(
                self.results["定时任务摘要"]["columns"],
                self.results["定时任务摘要"]["data"],
                col_widths=[Cm(3), Cm(13)]
            )
        if "可疑定时任务" in self.results:
            self._add_heading('10.4 可疑定时任务', level=2)
            self._add_table(
                self.results["可疑定时任务"]["columns"],
                self.results["可疑定时任务"]["data"]
            )

        # 11. 网络状态
        self._add_heading('11. 网络状态', level=1)
        if "网络接口信息" in self.results:
            self._add_heading('11.1 网络接口', level=2)
            for row in self.results["网络接口信息"]["data"]:
                self.doc.add_paragraph(clean_string(row[0]))
        if "网络连接状态" in self.results:
            self._add_heading('11.2 网络连接状态', level=2)
            self._add_table(
                self.results["网络连接状态"]["columns"],
                self.results["网络连接状态"]["data"]
            )
        if "监听端口" in self.results:
            self._add_heading('11.3 监听端口', level=2)
            self._add_table(
                self.results["监听端口"]["columns"],
                self.results["监听端口"]["data"],
                col_widths=[Cm(2), Cm(2), Cm(5), Cm(2)]
            )

        # 12. 巡检总结
        self._add_heading('12. 巡检总结', level=1)
        warnings = []
        if "系统句柄数分析" in self.results:
            for row in self.results["系统句柄数分析"]["data"]:
                if "句柄使用率" in row[0]:
                    try:
                        percent = float(row[1].strip('%'))
                        if percent > 80:
                            warnings.append(f"⚠️ 系统句柄使用率 {percent}% (超过80%)")
                    except:
                        pass
        if "CPU性能" in self.results:
            for row in self.results["CPU性能"]["data"]:
                if "CPU使用率" in row[0]:
                    try:
                        percent = float(row[1].strip('%'))
                        if percent > 80:
                            warnings.append(f"⚠️ CPU使用率 {percent}% (超过80%)")
                    except:
                        pass
        if "内存性能" in self.results:
            for row in self.results["内存性能"]["data"]:
                if "已使用" in row[0]:
                    m = re.search(r'\((\d+\.?\d*)%\)', row[1])
                    if m:
                        percent = float(m.group(1))
                        if percent > 80:
                            warnings.append(f"⚠️ 内存使用率 {percent}% (超过80%)")
        if "磁盘使用率" in self.results:
            for row in self.results["磁盘使用率"]["data"]:
                try:
                    use_val = int(row[4].strip('%'))
                    if use_val > 80:
                        warnings.append(f"⚠️ 磁盘 {row[0]} 使用率 {use_val}% (挂载点 {row[5]})")
                except:
                    pass
        if "可疑定时任务" in self.results:
            if len(self.results["可疑定时任务"]["data"]) > 0 and "未发现" not in str(self.results["可疑定时任务"]["data"][0][0]):
                warnings.append("⚠️ 发现可疑定时任务 (wget/curl/bash -i等)")

        p = self.doc.add_paragraph("📌 重点关注项:")
        p.runs[0].bold = True
        if warnings:
            for w in warnings[:10]:
                self.doc.add_paragraph(w, style='List Bullet')
        else:
            self.doc.add_paragraph("✅ 未发现明显异常", style='List Bullet')

        p = self.doc.add_paragraph("💡 建议措施:")
        p.runs[0].bold = True
        suggestions = [
            "定期检查系统更新，及时安装安全补丁",
            "监控系统资源使用，确保空闲资源充足",
            "优化高资源占用进程",
            "定期审计日志与定时任务",
            "遵循最小权限原则加强系统安全"
        ]
        for s in suggestions:
            self.doc.add_paragraph(s, style='List Bullet')

        if not self.output_path:
            timestamp = datetime.now().strftime('%Y%m%d_%H%M%S')
            safe_host = re.sub(r'[^\w\-_.]', '_', self.hostname)
            self.output_path = f"{safe_host}_OS巡检报告_{timestamp}.docx"
        self.doc.save(self.output_path)
        ConsolePrinter.success(f"Word报告已生成: {self.output_path}")
        return self.output_path

# ------------------------------------------------------------
# 批量巡检管理器
# ------------------------------------------------------------
class OSBatchInspectionManager:
    def __init__(self, encryptor):
        self.encryptor = encryptor
        self.template_dir = self._get_template_dir()

    def _get_template_dir(self):
        base = os.path.dirname(sys.executable) if getattr(sys, 'frozen', False) else os.path.dirname(os.path.abspath(__file__))
        tdir = os.path.join(base, 'os_inspection_templates')
        os.makedirs(tdir, exist_ok=True)
        return tdir

    def generate_excel_template(self, template_name=None):
        if not HAS_EXCEL:
            ConsolePrinter.error("openpyxl 未安装，无法生成Excel模板")
            return None
        if not template_name:
            timestamp = datetime.now().strftime('%Y%m%d_%H%M%S')
            template_name = f"os_batch_template_{timestamp}.xlsx"
        template_path = os.path.join(self.template_dir, template_name)

        wb = openpyxl.Workbook()
        ws = wb.active
        ws.title = "主机列表"

        headers = [
            "主机名(可选)", "IP地址", "SSH端口", "SSH用户", "SSH密码",
            "运维单位", "运维人员", "描述", "启用检查", "优先级"
        ]
        for col, h in enumerate(headers, 1):
            cell = ws.cell(1, col, h)
            cell.font = Font(bold=True, color="FFFFFF")
            cell.fill = PatternFill(start_color="2E5A62", end_color="2E5A62", fill_type="solid")
            cell.alignment = Alignment(horizontal="center")

        sample = [
            ["", "192.168.1.10", 22, "root", "password123",
             "中国移动", "陈松坡", "生产Web服务器", "是", 1],
            ["", "192.168.1.20", 22, "root", "password123",
             "中国移动", "陈松坡", "生产数据库", "是", 2],
        ]
        for row, data in enumerate(sample, 2):
            for col, val in enumerate(data, 1):
                ws.cell(row, col, val)

        instr = wb.create_sheet("使用说明")
        instr.merge_cells('A1:B1')
        instr['A1'] = "操作系统批量巡检模板使用说明"
        instr['A1'].font = Font(bold=True, size=14)
        rows = [
            ["", ""],
            ["📋 必填字段", "IP地址, SSH端口, SSH用户, SSH密码"],
            ["🔧 可选字段", "主机名(可选), 运维单位, 运维人员, 描述"],
            ["⚡ 启用检查", "填写'是'或'否'，默认'是'"],
            ["🔢 优先级", "数字越小越优先执行"],
            ["", ""],
            ["🔒 密码安全", "模板保存时会自动加密密码字段，跨机器不可用"],
            ["🏷️ 主机名", "若不填写，巡检时将自动使用远程主机的主机名或IP地址"],
        ]
        for i, r in enumerate(rows, 3):
            instr.cell(i, 1, r[0])
            instr.cell(i, 2, r[1])

        wb.save(template_path)
        ConsolePrinter.success(f"Excel模板已生成: {template_path}")
        self._encrypt_excel_passwords(template_path)
        return template_path

    def _encrypt_excel_passwords(self, path):
        """加密指定Excel文件中的密码列"""
        if not HAS_EXCEL:
            return
        try:
            wb = openpyxl.load_workbook(path)
            ws = wb["主机列表"]
            headers = [ws.cell(1, c).value for c in range(1, 11) if ws.cell(1, c).value]
            pwd_col = None
            for idx, h in enumerate(headers, 1):
                if h == "SSH密码":
                    pwd_col = idx
                    break
            if pwd_col:
                for row in range(2, ws.max_row + 1):
                    val = ws.cell(row, pwd_col).value
                    if val and not self._is_encrypted(str(val)):
                        ws.cell(row, pwd_col).value = self.encryptor.encrypt_password(val)
                wb.save(path)
        except Exception as e:
            ConsolePrinter.warning(f"⚠️ 密码加密失败: {e}")

    def _is_encrypted(self, s):
        """判断字符串是否看起来像是加密后的密文"""
        try:
            return len(str(s)) > 50 and re.match(r'^[A-Za-z0-9-_]*={0,2}$', str(s))
        except:
            return False

    def load_excel_template(self, path):
        """
        加载Excel模板，并在此过程中检测明文密码。
        如果发现明文密码，立即加密并回写文件。
        """
        if not HAS_EXCEL:
            ConsolePrinter.error("openpyxl 未安装，无法加载模板")
            return []
        
        # 1. 先读取文件
        wb = openpyxl.load_workbook(path)
        ws = wb["主机列表"]
        headers = []
        for col in range(1, 11):
            val = ws.cell(1, col).value
            if val:
                headers.append(val)
        
        # 2. 定位密码列
        pwd_col_idx = None
        for idx, h in enumerate(headers, 1):
            if h == "SSH密码":
                pwd_col_idx = idx
                break
        
        # 3. 遍历数据，检查是否有明文密码需要加密
        need_resave = False
        hosts = []
        
        for row in range(2, ws.max_row + 1):
            enabled = ws.cell(row, 9).value
            if enabled and str(enabled).strip().lower() not in ['否', 'no', 'false', '0']:
                host = {}
                for col, h in enumerate(headers, 1):
                    val = ws.cell(row, col).value
                    
                    if h == "主机名(可选)":
                        host['name'] = str(val).strip() if val and str(val).strip() else None
                    elif h == "IP地址":
                        host['host'] = str(val)
                    elif h == "SSH端口":
                        host['ssh_port'] = int(val) if val else 22
                    elif h == "SSH用户":
                        host['ssh_user'] = str(val) if val else 'root'
                    elif h == "SSH密码":
                        # 【核心修复逻辑】
                        current_pwd = str(val) if val else ''
                        if current_pwd and not self._is_encrypted(current_pwd):
                            # 发现明文密码！
                            logger.info(f"[安全] 发现明文密码 (行 {row})，正在加密...")
                            encrypted_pwd = self.encryptor.encrypt_password(current_pwd)
                            # 更新内存中的对象
                            host['ssh_password'] = encrypted_pwd
                            # 回写 Excel 单元格
                            ws.cell(row, col).value = encrypted_pwd
                            need_resave = True
                        else:
                            host['ssh_password'] = current_pwd
                    elif h == "运维单位":
                        host['operation_unit'] = str(val) if val else "中国移动"
                    elif h == "运维人员":
                        host['operator'] = str(val) if val else "陈松坡"
                    elif h == "描述":
                        host['description'] = str(val) if val else ""
                    elif h == "优先级":
                        host['priority'] = int(val) if val else 999
                
                if 'host' in host and host['host']:
                    hosts.append(host)
        
        # 4. 如果进行了加密操作，保存文件
        if need_resave:
            try:
                wb.save(path)
                ConsolePrinter.success("🔐 检测到明文密码，已自动加密并保存模板")
                logger.info(f"模板 {path} 已更新，密码已加密")
            except Exception as e:
                ConsolePrinter.error(f"❌ 无法回写加密后的模板，请检查文件是否被占用: {e}")
                logger.error(f"保存Excel失败: {e}")
        
        return hosts

    def run_batch_inspection(self, hosts, max_workers=3):
        ConsolePrinter.title(f"开始批量巡检，共 {len(hosts)} 台主机")
        logger.info(f"批量巡检任务启动，主机数: {len(hosts)}")
        timestamp = datetime.now().strftime('%Y%m%d_%H%M%S')
        report_dir = os.path.join(self.template_dir, f"巡检报告_{timestamp}")
        os.makedirs(report_dir, exist_ok=True)

        success = []
        failed = []
        with ThreadPoolExecutor(max_workers=max_workers) as executor:
            future_map = {executor.submit(self._inspect_single, h, report_dir): h for h in hosts}
            total = len(future_map)
            for i, future in enumerate(as_completed(future_map), 1):
                h = future_map[future]
                try:
                    result = future.result(timeout=600) # 单台总超时10分钟
                    if result and isinstance(result, tuple) and len(result) == 2:
                        display_name, report_path = result
                        success.append((display_name, report_path))
                        ConsolePrinter.success(f"[{i}/{total}] {display_name} ({h['host']}) 完成")
                    else:
                        failed_name = h.get('name') or h['host']
                        failed.append(failed_name)
                        ConsolePrinter.error(f"[{i}/{total}] {failed_name} 失败 (未生成报告)")
                except Exception as e:
                    failed_name = h.get('name') or h['host']
                    failed.append(failed_name)
                    logger.error(f"主机 {failed_name} 巡检异常", exc_info=True)
                    ConsolePrinter.error(f"[{i}/{total}] {failed_name} 异常: {e}")
        self._generate_summary(success, failed, hosts, report_dir)
        return success, failed

    def _inspect_single(self, host_info, report_dir):
        try:
            checker = OSSysChecker(host_info, self.encryptor)
            results = checker.run_all()
            display_name = host_info.get('name')
            if not display_name:
                display_name = checker.hostname or host_info['host']
            op_unit = host_info.get('operation_unit', '中国移动')
            operator = host_info.get('operator', '陈松坡')
            timestamp = datetime.now().strftime('%Y%m%d_%H%M%S')

            host_ip = host_info['host']
            safe_ip = re.sub(r'[^\w\-_.]', '_', host_ip)
            out_path = os.path.join(report_dir, f"{safe_ip}_巡检报告_{timestamp}.docx")

            generator = OSReportGenerator(results, checker.hostname, out_path, op_unit, operator)
            report_path = generator.generate()
            return (display_name, report_path) if report_path else None
        except Exception as e:
            logger.error(f"_inspect_single 内部错误: {e}", exc_info=True)
            return None

    def _generate_summary(self, success, failed, all_hosts, report_dir):
        summary_path = os.path.join(report_dir, f"批量巡检汇总_{datetime.now().strftime('%Y%m%d_%H%M%S')}.txt")
        with open(summary_path, 'w', encoding='utf-8') as f:
            f.write("="*60 + "\n")
            f.write("操作系统批量巡检汇总报告\n")
            f.write("="*60 + "\n\n")
            f.write(f"巡检时间: {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}\n")
            f.write(f"总主机数: {len(all_hosts)}\n")
            f.write(f"成功: {len(success)}\n")
            f.write(f"失败: {len(failed)}\n\n")
            if success:
                f.write("✅ 成功主机:\n")
                for name, path in success:
                    f.write(f"  - {name}: {path}\n")
            if failed:
                f.write("\n❌ 失败主机:\n")
                for name in failed:
                    f.write(f"  - {name}\n")
        ConsolePrinter.success(f"汇总报告已生成: {summary_path}")
        ConsolePrinter.info(f"💡 详细调试日志已保存至: /tmp/os_inspector_debug.log")

# ------------------------------------------------------------
# 日志查看器
# ------------------------------------------------------------
def view_logs():
    log_file = '/tmp/os_inspector_debug.log'
    if not os.path.exists(log_file):
        ConsolePrinter.error("调试日志文件不存在")
        return
    ConsolePrinter.title("详细调试日志 (最近100行)")
    try:
        with open(log_file, 'r', encoding='utf-8') as f:
            lines = f.readlines()[-100:]
            for line in lines:
                print(line.strip())
    except Exception as e:
        print(f"读取日志失败: {e}")
    input("\n⏎ 按回车键返回")

# ------------------------------------------------------------
# 主菜单
# ------------------------------------------------------------
def main():
    encryptor = PasswordEncryptor()
    manager = OSBatchInspectionManager(encryptor)

    while True:
        ConsolePrinter.title("PASS层批量巡检工具 v3.2")
        print("1. 🚀 批量巡检")
        print("2. 📁 创建 Excel 模板")
        print("3. 📜 查看调试日志")
        print("4. ❌ 退出")
        ConsolePrinter.separator()
        choice = input("请选择操作 [1-4]: ").strip()

        if choice == '1':
            templates = [f for f in os.listdir(manager.template_dir) if f.endswith('.xlsx')]
            if not templates:
                ConsolePrinter.warning("尚未生成模板，请先执行选项2")
                continue
            print("\n📁 可用模板:")
            for i, t in enumerate(templates, 1):
                print(f"  {i}. {t}")
            sel = input("请选择模板序号: ").strip()
            try:
                idx = int(sel) - 1
                tpl_path = os.path.join(manager.template_dir, templates[idx])
            except:
                ConsolePrinter.error("无效选择")
                continue
            
            # 加载模板 (此函数内部已包含自动加密逻辑)
            hosts = manager.load_excel_template(tpl_path)
            
            if not hosts:
                ConsolePrinter.error("模板中无有效主机")
                continue
            max_workers = input("⚡ 并发数量 [3]: ").strip()
            max_workers = int(max_workers) if max_workers.isdigit() else 3
            manager.run_batch_inspection(hosts, max_workers)

        elif choice == '2':
            if not HAS_EXCEL:
                ConsolePrinter.error("openpyxl 未安装，无法生成模板")
                continue
            name = input("📝 模板文件名 (回车使用默认名称): ").strip()
            manager.generate_excel_template(name if name else None)

        elif choice == '3':
            view_logs()

        elif choice == '4':
            ConsolePrinter.success("👋 再见！")
            break
        else:
            ConsolePrinter.error("无效输入")

if __name__ == "__main__":
    if sys.version_info < (3, 6):
        ConsolePrinter.error("需要 Python 3.6+")
        sys.exit(1)
    main()