#!/bin/bash
# 分析"每 9 分钟一次异常"的周期性 —— 到底是谁在定期动手
set -u

echo "════════ 1. 异常轮询的时刻 ════════"
awk -F'\t' '$3>90000 || $2!="200" {print "  #" $1 "  " $4 "  码=" $2 "  " $3 "ms"}' \
    /root/rp_poll30.tsv 2>/dev/null

echo
echo "════════ 2. 连接数掉到 3 以下的时刻（全量）════════"
awk -F'\t' 'NR>1 && $2 ~ /^[0-9]+$/ && $3 ~ /^[0-9]+$/ && ($2+$3)<4 {
    print "  " $1 "  quic=" $2 " http2=" $3
}' /root/long2h_conns.tsv 2>/dev/null

echo
echo "════════ 3. 这些时刻前后 watchdog 做了什么 ════════"
tail -40 /root/lanremote-relay/watchdog.log 2>/dev/null | sed 's/^/  /'

echo
echo "════════ 4. QUIC 实例的连接事件（最近 40 条）════════"
grep -E 'Registered|Lost|Unregistered' /root/lanremote-relay/tunnel.log 2>/dev/null \
    | tail -40 | sed -E 's/^(....-..-..T..:..):[0-9]+Z .*(Registered tunnel connection|Lost connection|Unregistered).*ip=([0-9.]+).*location=([a-z0-9]+).*/\1 \2 \3 \4/' \
    | sed 's/^/  /'

echo
echo "════════ 5. 有没有周期性（看事件间隔）════════"
echo "  最近 20 次 Lost connection 的时间:"
grep 'Lost connection' /root/lanremote-relay/tunnel.log 2>/dev/null \
    | tail -20 | cut -c1-19 | sed 's/^/    /'

echo
echo "════════ 6. 线程/进程层面：cloudflared 有没有重启过 ════════"
echo "  QUIC 实例进程启动时间: $(ps -o lstart= -p $(pgrep -f 'protocol quic' | head -1) 2>/dev/null)"
echo "  HTTP/2 实例进程启动时间: $(ps -o lstart= -p $(pgrep -f 'protocol http2' | head -1) 2>/dev/null)"
echo "  QUIC 服务重启次数（本次开机以来）:"
journalctl -u lanremote-tunnel --since '2 hours ago' --no-pager 2>/dev/null \
    | grep -c 'Starting\|Stopped' | sed 's/^/    /'

echo
echo "════════ 7. 系统层面有没有定期任务 ════════"
echo "  systemd timer:"
systemctl list-timers --no-pager 2>/dev/null | head -12 | sed 's/^/    /'
echo "  cron:"
crontab -l 2>/dev/null | grep -v '^#' | sed 's/^/    /' || echo "    （空）"

echo
echo "════════ 8. 连接数变化明细（最近 30 条采样）════════"
tail -30 /root/long2h_conns.tsv 2>/dev/null | sed 's/^/  /'