feature 添加延迟，添加文件锁，防止多实例运行

asset/rsyslog.conf

 # rsyslog配置，将指定服务的日志发送到socket里
 
 $ModLoad omuxsock
-$OMUxSockSocket /tmp/mysock
+$OMUxSockSocket /tmp/rsyslog.sock
 authpriv.* :omuxsock:

build.sh

+cd cmd/daemon
+go clean
+go build -ldflags="-s -w"
+if type upx > /dev/null; then
+    upx daemon
+fi
\ No newline at end of file

cmd/daemon/gin.go

@@ -9,12 +9,11 @@ import (
 )
 
 var (
-	GIN_SOCK_PATH = "/tmp/gin.sock"
+	GIN_SOCK_PATH = "/tmp/sshd-tool.sock"
 )
 
-func InitGin() {
+func InitGin() net.Listener {
 	os.RemoveAll(GIN_SOCK_PATH)
-
 	sock, err := net.Listen("unix", GIN_SOCK_PATH)
 	if err != nil {
 		log.Fatalf("error listen unix socket %s: %v", GIN_SOCK_PATH, err)
@@ -24,8 +23,8 @@ func InitGin() {
 		sock.Close()
 		log.Fatalf("error chmod of %s: %v", GIN_SOCK_PATH, err)
 	}
-
 	g := gin.Default()
-	g.Any("/", getLoginedUserInfo)
+	g.GET("/user", getLoginedUserInfo)
 	go g.RunListener(sock)
+	return sock
 }

cmd/daemon/main.go

 package main
 
 import (
+	"fmt"
 	"log"
 	"net"
 	"os"
 	"os/signal"
 	"sync"
 	"syscall"
+
+	"github.com/gofrs/flock"
+	"github.com/spf13/pflag"
 )
 
 var (
 	wg       = sync.WaitGroup{}
+	helpFlag = pflag.BoolP("help", "p", false, "show help")
 )
 
 func main() {
+	socketPath := "/tmp/rsyslog.sock"
+	pflag.Parse()
+	if *helpFlag {
+		fmt.Printf("%s: \nObtain SSHD logs from rsyslog, record them, and provide query services.\n", os.Args[0])
+		fmt.Printf("You need to forward the sshd logs to the Unix socket(%s) via rsyslog.\n", socketPath)
+		fmt.Printf("You can access the Unix socket(%s) to obtain online user information.\n", GIN_SOCK_PATH)
+		fmt.Println("such as: curl -s --unix-socket /tmp//tmp/sshd-tool.sock http://localhost/user | jq")
+		return
+	}
+
+	fileLock := flock.New("/var/lock/sshd-tool.lock", flock.SetPermissions(0644))
+	l, err := fileLock.TryLock()
+	if err != nil {
+		log.Fatalf("error lock file /var/lock/sshd-tool.lock, %v", err)
+	}
+	if !l {
+		log.Fatalf("can't lock /var/lock/sshd-tool.lock, Perhaps an instance is already running.")
+	}
+
 	InitSSH()
-	InitGin()
+	serverListener := InitGin()
 
-	socketPath := "/tmp/mysock"
-	err := os.RemoveAll(socketPath)
+	err = os.RemoveAll(socketPath)
 
 	if err != nil {
 		log.Fatalf("error delete %s: %v", socketPath, err)
@@ -42,10 +65,16 @@ func main() {
 		select {
 		case <-sigChan:
 			conn.Close()
+			serverListener.Close()
 			os.Remove(socketPath)
+			os.Remove(GIN_SOCK_PATH)
+			fileLock.Unlock()
 		case <-globalCtx.Done():
 			conn.Close()
+			serverListener.Close()
 			os.Remove(socketPath)
+			os.Remove(GIN_SOCK_PATH)
+			fileLock.Unlock()
 		}
 		wg.Done()
 	}(&wg)

cmd/daemon/query

 #!/bin/bash
 
-curl -s --unix-socket /tmp/gin.sock http://localhost | jq
+curl -s --unix-socket /tmp//tmp/sshd-tool.sock http://localhost/user | jq
\ No newline at end of file

cmd/daemon/sshd.go

@@ -332,6 +332,7 @@ func handleSSHLoginPK(str string) {
 		return
 	}
 	var on *utils.OnlineUser
+	time.Sleep(time.Second)
 	cPids, err := utils.GetPidChild2(pid)
 	if err == nil {
 		on = getOnline(pid, cPids...)
@@ -357,6 +358,7 @@ func handleSSHLogin(str string) {
 		return
 	}
 	var on *utils.OnlineUser
+	time.Sleep(time.Second)
 	cPids, err := utils.GetPidChild2(pid)
 	if err == nil {
 		on = getOnline(pid, cPids...)
@@ -367,10 +369,6 @@ func handleSSHLogin(str string) {
 		log.Printf("sshd login, but who not find: %d,%s", pid, fields[4])
 		return
 	}
-	if on == nil {
-		log.Printf("sshd login, but who not find: %d,%s", pid, fields[4])
-		return
-	}
 	u := NewLoginedUer(on, &auth, nil, nil)
 	loginedLock.Lock()
 	loginedUser[u.Online.Pid] = u
@@ -395,5 +393,9 @@ func getLoginedUserInfo(ctx *gin.Context) {
 	rl := loginedLock.RLocker()
 	rl.Lock()
 	defer rl.Unlock()
-	ctx.JSON(200, loginedUser)
+	result := make([]*LoginedUser, 0, len(loginedUser))
+	for _, v := range loginedUser {
+		result = append(result, v)
+	}
+	ctx.JSON(200, result)
 }

go.mod

@@ -15,6 +15,7 @@ require (
 	github.com/go-playground/validator/v10 v10.27.0 // indirect
 	github.com/goccy/go-json v0.10.2 // indirect
 	github.com/goccy/go-yaml v1.18.0 // indirect
+	github.com/gofrs/flock v0.13.0
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
 	github.com/leodido/go-urn v1.4.0 // indirect
@@ -24,6 +25,7 @@ require (
 	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
 	github.com/quic-go/qpack v0.5.1 // indirect
 	github.com/quic-go/quic-go v0.54.0 // indirect
+	github.com/spf13/pflag v1.0.10
 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
 	github.com/ugorji/go/codec v1.3.0 // indirect
 	go.uber.org/mock v0.5.0 // indirect
@@ -32,7 +34,7 @@ require (
 	golang.org/x/mod v0.25.0 // indirect
 	golang.org/x/net v0.42.0 // indirect
 	golang.org/x/sync v0.16.0 // indirect
-	golang.org/x/sys v0.35.0 // indirect
+	golang.org/x/sys v0.37.0 // indirect
 	golang.org/x/text v0.27.0 // indirect
 	golang.org/x/tools v0.34.0 // indirect
 	google.golang.org/protobuf v1.36.9 // indirect

go.sum

@@ -22,6 +22,8 @@ github.com/goccy/go-json v0.10.2 h1:CrxCmQqYDkv1z7lO7Wbh2HN93uovUHgrECaO5ZrCXAU=
 github.com/goccy/go-json v0.10.2/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
 github.com/goccy/go-yaml v1.18.0 h1:8W7wMFS12Pcas7KU+VVkaiCng+kG8QiFeFwzFb+rwuw=
 github.com/goccy/go-yaml v1.18.0/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
+github.com/gofrs/flock v0.13.0 h1:95JolYOvGMqeH31+FC7D2+uULf6mG61mEZ/A8dRYMzw=
+github.com/gofrs/flock v0.13.0/go.mod h1:jxeyy9R1auM5S6JYDBhDt+E2TCo7DkratH4Pgi8P+Z0=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
@@ -42,6 +44,8 @@ github.com/quic-go/qpack v0.5.1 h1:giqksBPnT/HDtZ6VhtFKgoLOWmlyo9Ei6u9PqzIMbhI=
 github.com/quic-go/qpack v0.5.1/go.mod h1:+PC4XFrEskIVkcLzpEkbLqq1uCoxPhQuvK5rH1ZgaEg=
 github.com/quic-go/quic-go v0.54.0 h1:6s1YB9QotYI6Ospeiguknbp2Znb/jZYjZLRXn9kMQBg=
 github.com/quic-go/quic-go v0.54.0/go.mod h1:e68ZEaCdyviluZmy44P6Iey98v/Wfz6HCjQEm+l8zTY=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
+github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
@@ -68,6 +72,8 @@ golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI=
 golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.37.0 h1:fdNQudmxPjkdUTPnLn5mdQv7Zwvbvpaxqs831goi9kQ=
+golang.org/x/sys v0.37.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 golang.org/x/text v0.27.0 h1:4fGWRpyh641NLlecmyl4LOe6yDdfaYNrGb2zdfo4JV4=
 golang.org/x/text v0.27.0/go.mod h1:1D28KMCvyooCX9hBiosv5Tz/+YLxj0j7XhWjpSUF7CU=
 golang.org/x/tools v0.34.0 h1:qIpSLOxeCYGg9TrcJokLBG4KFA6d795g0xkBkiESGlo=