#!/usr/bin/env bash
# MAX LogCheck — 系统日志与磁盘增长分析
# 风险等级: 🟢 只读 — 不修改任何系统设置
# 用法: bash <(curl -fsSL https://dl.unvmax.com/linux/scripts/max-tools/max-logcheck.sh)
set -Eeuo pipefail

BC='\033[38;5;220m'; BG='\033[38;5;220m'; Y='\033[1;33m'; R='\033[0;31m'
BW='\033[38;5;255m'; W='\033[38;5;250m'; GR='\033[38;5;242m'; N='\033[0m'
section(){ printf '\n  %b── %s ─────────────────────────────────%b\n' "$BC" "$1" "$N"; }
value(){ printf '  %b%-16s%b %s\n' "$W" "$1" "$N" "$2"; }

printf '\n  %b┌──────────────────────────────────────────────────┐%b\n' "$BC" "$N"
printf '  %b│     MAX 日志与磁盘增长分析  %b(只读诊断)%b\n' "$BG" "$GR" "$N"
printf '  %b└──────────────────────────────────────────────────┘%b\n' "$BC" "$N"

section '日志占用'
if [[ -d /var/log ]]; then
  value '/var/log 总计' "$(du -sh /var/log 2>/dev/null | awk '{print $1}' || echo '无法读取')"
  find /var/log -type f -printf '%s %p\n' 2>/dev/null | sort -rn | head -10 | while read -r bytes path; do
    size=$(numfmt --to=iec-i --suffix=B "$bytes" 2>/dev/null || echo "${bytes}B")
    printf '    %b%-10s%b %s\n' "$BW" "$size" "$N" "$path"
  done
else
  printf '  %b⚠ 未找到 /var/log%b\n' "$Y" "$N"
fi

section 'systemd journal'
if command -v journalctl >/dev/null 2>&1; then
  usage=$(journalctl --disk-usage 2>/dev/null | sed 's/^.*take up //')
  value 'Journal 占用' "${usage:-无法读取}"
  for level in err warning; do
    count=$(journalctl -p "$level" --since '24 hours ago' --no-pager 2>/dev/null | wc -l)
    color="$BG"; (( count > 0 )) && color="$Y"
    printf '  %b%-16s%b %s 条（近 24 小时）\n' "$color" "${level} 日志" "$N" "$count"
  done
else
  printf '  %b⚠ journalctl 不可用%b\n' "$Y" "$N"
fi

section '空间压力'
df -P -x tmpfs -x devtmpfs 2>/dev/null | awk 'NR>1 {print $5, $6}' | while read -r pct mount; do
  n=${pct%%%}; color="$BG"
  (( n >= 90 )) && color="$R" || { (( n >= 80 )) && color="$Y"; }
  printf '  %b%-8s%b %s 已使用\n' "$color" "$mount" "$N" "$pct"
done

section '最近修改的大文件（/var/log）'
find /var/log -type f -size +10M -mtime -7 -printf '%TY-%Tm-%Td %TH:%TM %s %p\n' 2>/dev/null | sort -r | head -10 | while read -r date time bytes path; do
  size=$(numfmt --to=iec-i --suffix=B "$bytes" 2>/dev/null || echo "${bytes}B")
  printf '    %b%s%b  %-10s %s\n' "$GR" "$date $time" "$N" "$size" "$path"
done

printf '\n  %b────────────────────────────────────────────────────%b\n' "$GR" "$N"
printf '  %b✔ 日志检查完成%b  仅分析，不清理任何日志。\n\n' "$BG" "$N"