# patch_collector.py
import subprocess
import platform
import requests
from datetime import datetime
import json
import re

class PatchCollector:
    """VPS 补丁信息收集器"""
    
    def __init__(self):
        self.os_type = platform.system()
        self.os_version = platform.release()
        self.host_name = platform.node()
    
    def get_system_info(self):
        """获取系统基本信息"""
        return {
            'hostname': self.host_name,
            'os': self.os_type,
            'version': self.os_version,
            'architecture': platform.machine(),
            'cpu_count': subprocess.getoutput('nproc' if self.os_type == 'Linux' else 'sysctl -n hw.ncpu'),
            'memory_total': subprocess.getoutput('free -g | awk \'NR==2{print $2}\'') if self.os_type == 'Linux' else 'N/A',
            'uptime': subprocess.getoutput('uptime -s') if self.os_type == 'Linux' else 'N/A'
        }
    
    def get_available_patches(self):
        """获取可用补丁列表"""
        patches = []
        
        if self.os_type == 'Linux':
            patches = self._get_linux_patches()
        elif self.os_type == 'Windows':
            patches = self._get_windows_patches()
        
        return patches
    
    def _get_linux_patches(self):
        """获取 Linux 系统补丁"""
        patches = []
        
        # Debian/Ubuntu 系统
        if subprocess.getoutput('which apt-get') == '/usr/bin/apt-get':
            try:
                result = subprocess.run(
                    ['apt', 'list', '--upgradable'],
                    capture_output=True, text=True, timeout=60
                )
                for line in result.stdout.split('\n'):
                    if 'upgradable' in line:
                        patch = self._parse_apt_line(line)
                        if patch:
                            patches.append(patch)
            except Exception as e:
                patches.append({'error': str(e)})
        
        # RHEL/CentOS 系统
        elif subprocess.getoutput('which yum') == '/usr/bin/yum':
            try:
                result = subprocess.run(
                    ['yum', 'check-update'],
                    capture_output=True, text=True, timeout=60
                )
                for line in result.stdout.split('\n'):
                    if line.strip() and not line.startswith('Loaded'):
                        patch = self._parse_yum_line(line)
                        if patch:
                            patches.append(patch)
            except Exception as e:
                patches.append({'error': str(e)})
        
        return patches
    
    def _parse_apt_line(self, line):
        """解析 apt 输出"""
        match = re.search(r'(\S+)\s+(\S+)\s+->\s+(\S+)', line)
        if match:
            return {
                'name': match.group(1),
                'current_version': match.group(2),
                'new_version': match.group(3),
                'type': 'apt',
                'priority': 'normal'
            }
        return None
    
    def _parse_yum_line(self, line):
        """解析 yum 输出"""
        parts = line.strip().split()
        if len(parts) >= 2:
            return {
                'name': parts[0],
                'type': 'yum',
                'priority': 'normal'
            }
        return None
    
    def get_security_patches(self):
        """获取安全相关补丁"""
        all_patches = self.get_available_patches()
        security_keywords = ['security', 'safety', 'vulnerability', 'CVE', 'fix']
        
        security_patches = []
        for patch in all_patches:
            if isinstance(patch, dict) and 'name' in patch:
                patch_text = json.dumps(patch).lower()
                if any(kw in patch_text for kw in security_keywords):
                    patch['priority'] = 'high'
                    security_patches.append(patch)
        
        return security_patches
    
    def get_update_history(self):
        """获取历史更新记录"""
        history = []
        
        if self.os_type == 'Linux':
            # 读取 apt/dpkg 日志
            try:
                result = subprocess.run(
                    ['grep', '-E', '(install|remove|upgrade)', '/var/log/dpkg.log'],
                    capture_output=True, text=True, timeout=30
                )
                for line in result.stdout.split('\n')[-50:]:  # 最近 50 条
                    history.append({
                        'timestamp': line.split()[0] if line else '',
                        'action': line.split()[2] if len(line.split()) > 2 else '',
                        'package': line.split()[3] if len(line.split()) > 3 else ''
                    })
            except:
                pass
        
        return history
    
    def get_business_calendar(self):
        """获取业务日历（高峰期/维护窗口）"""
        # 实际应用中可以从日历 API 或配置文件读取
        return {
            'maintenance_window': {
                'day_of_week': [6],  # 周六
                'start_hour': 2,
                'end_hour': 6
            },
            'peak_hours': {
                'days': [1, 2, 3, 4, 5],  # 工作日
                'hours': [9, 10, 11, 14, 15, 16]
            }
        }
    
    def collect_all(self):
        """收集所有补丁相关数据"""
        return {
            'collected_at': datetime.now().isoformat(),
            'system_info': self.get_system_info(),
            'available_patches': self.get_available_patches(),
            'security_patches': self.get_security_patches(),
            'update_history': self.get_update_history(),
            'business_calendar': self.get_business_calendar()
        }

# patch_analyzer.py
import numpy as np
from datetime import datetime, timedelta
import json

class PatchAnalyzer:
    """基于 AI 的补丁分析器"""
    
    def __init__(self):
        self.risk_factors = {
            'cve_severity': 0.3,      # CVE 严重性权重
            'exploit_available': 0.25, # 利用代码可用性
            'system_criticality': 0.2, # 系统重要性
            'patch_type': 0.15,        # 补丁类型
            'historical_success': 0.1  # 历史成功率
        }
    
    def analyze_patches(self, patch_data):
        """分析所有补丁并返回优先级排序"""
        patches = patch_data.get('available_patches', [])
        security_patches = patch_data.get('security_patches', [])
        
        # 为每个补丁计算风险评分
        scored_patches = []
        for patch in patches:
            score = self._calculate_patch_score(patch, patch_data)
            scored_patches.append({
                **patch,
                'risk_score': score['total'],
                'risk_level': score['level'],
                'recommendation': score['recommendation'],
                'analysis_time': datetime.now().isoformat()
            })
        
        # 按风险评分排序
        scored_patches.sort(key=lambda x: x['risk_score'], reverse=True)
        
        return {
            'total_patches': len(patches),
            'security_patches': len(security_patches),
            'critical_count': sum(1 for p in scored_patches if p['risk_level'] == 'critical'),
            'high_count': sum(1 for p in scored_patches if p['risk_level'] == 'high'),
            'priority_patches': scored_patches[:10],  # 前 10 个最高优先级
            'all_patches': scored_patches
        }
    
    def _calculate_patch_score(self, patch, context):
        """计算单个补丁的风险评分"""
        scores = {}
        
        # 1. CVE 严重性评分 (0-10)
        cve_score = self._assess_cve_severity(patch)
        scores['cve_severity'] = cve_score * self.risk_factors['cve_severity']
        
        # 2. 利用代码可用性 (0-10)
        exploit_score = self._check_exploit_availability(patch)
        scores['exploit_available'] = exploit_score * self.risk_factors['exploit_available']
        
        # 3. 系统重要性 (0-10)
        system_score = self._assess_system_criticality(patch, context)
        scores['system_criticality'] = system_score * self.risk_factors['system_criticality']
        
        # 4. 补丁类型 (0-10)
        type_score = self._assess_patch_type(patch)
        scores['patch_type'] = type_score * self.risk_factors['patch_type']
        
        # 5. 历史成功率 (0-10)
        success_score = self._check_history_success(patch, context)
        scores['historical_success'] = (10 - success_score) * self.risk_factors['historical_success']
        
        # 计算总分
        total = sum(scores.values())
        
        # 确定风险等级
        if total >= 8:
            level = 'critical'
            recommendation = '立即更新'
        elif total >= 6:
            level = 'high'
            recommendation = '尽快更新'
        elif total >= 4:
            level = 'medium'
            recommendation = '计划更新'
        else:
            level = 'low'
            recommendation = '常规更新'
        
        return {
            **scores,
            'total': round(total, 2),
            'level': level,
            'recommendation': recommendation
        }
    
    def _assess_cve_severity(self, patch):
        """评估 CVE 严重性"""
        # 实际应用中可以查询 CVE 数据库
        name = patch.get('name', '').lower()
        
        # 关键字匹配严重性
        critical_keywords = ['remote code execution', 'privilege escalation', 'buffer overflow', 'authentication bypass']
        high_keywords = ['information disclosure', 'denial of service', 'cross-site scripting']
        medium_keywords = ['minor fix', 'documentation', 'cosmetic']
        
        for keyword in critical_keywords:
            if keyword in name:
                return 10
        
        for keyword in high_keywords:
            if keyword in name:
                return 7
        
        return 5  # 默认中等严重性
    
    def _check_exploit_availability(self, patch):
        """检查利用代码可用性"""
        # 实际应用中查询 Exploit-DB 或 NVD
        # 这里简化处理
        return 3  # 默认中等风险
    
    def _assess_system_criticality(self, patch, context):
        """评估系统重要性"""
        # 根据补丁影响的系统组件评估
        system_info = context.get('system_info', {})
        
        # Web 服务器补丁优先级更高
        if any(pkg in patch.get('name', '') for pkg in ['nginx', 'apache', 'httpd', 'php', 'node']):
            return 8
        
        # 数据库补丁
        if any(pkg in patch.get('name', '') for pkg in ['mysql', 'postgres', 'mariadb']):
            return 9
        
        # 安全相关组件
        if any(pkg in patch.get('name', '') for pkg in ['openssh', 'openssl', 'sudo', 'sudoers']):
            return 10
        
        return 5
    
    def _assess_patch_type(self, patch):
        """评估补丁类型"""
        patch_type = patch.get('type', '')
        
        if patch_type == 'security':
            return 10
        elif patch_type == 'critical':
            return 9
        elif patch_type == 'important':
            return 7
        else:
            return 5
    
    def _check_history_success(self, patch, context):
        """检查历史更新成功率"""
        history = context.get('update_history', [])
        
        # 简化：返回默认值
        return 5
    
    def predict_update_risk(self, patch_data):
        """预测补丁更新的风险"""
        analysis = self.analyze_patches(patch_data)
        
        critical_count = analysis['critical_count']
        total = analysis['total_patches']
        
        # 风险预测模型（简化版）
        if critical_count > 5:
            risk_level = 'high'
            reason = '存在多个关键补丁，建议分批更新'
        elif critical_count > 0:
            risk_level = 'medium'
            reason = '存在关键补丁，需要谨慎更新'
        else:
            risk_level = 'low'
            reason = '常规补丁更新，风险较低'
        
        return {
            'risk_level': risk_level,
            'reason': reason,
            'critical_patches': critical_count,
            'suggested_action': '分批更新' if critical_count > 3 else '一次性更新'
        }
    
    def suggest_update_window(self, patch_data):
        """建议最佳更新窗口"""
        calendar = patch_data.get('business_calendar', {})
        maintenance = calendar.get('maintenance_window', {})
        
        # 返回建议的维护窗口
        return {
            'recommended_day': 'Saturday' if 6 in maintenance.get('day_of_week', []) else 'Sunday',
            'recommended_start': f"{maintenance.get('start_hour', 2):02d}:00",
            'recommended_end': f"{maintenance.get('end_hour', 6):02d}:00",
            'reason': '业务低峰期，影响最小'
        }

# patch_decision.py
from datetime import datetime, timedelta
import json

class PatchDecisionEngine:
    """补丁更新决策引擎"""
    
    def __init__(self, config):
        self.config = config
        self.min_interval = config.get('min_update_interval_hours', 24)
        self.max_concurrent = config.get('max_concurrent_updates', 1)
        self.auto_approved_levels = config.get('auto_approved_levels', ['low', 'medium'])
    
    def make_decision(self, analysis, risk_prediction, window_suggestion):
        """生成补丁更新决策"""
        decision = {
            'timestamp': datetime.now().isoformat(),
            'actions': [],
            'summary': {}
        }
        
        # 分析各优先级补丁
        priority_patches = analysis.get('priority_patches', [])
        
        for patch in priority_patches:
            action = self._decide_patch_action(patch, analysis, risk_prediction)
            decision['actions'].append(action)
        
        # 生成总体决策
        decision['summary'] = self._generate_summary(decision['actions'], window_suggestion)
        
        return decision
    
    def _decide_patch_action(self, patch, analysis, risk_prediction):
        """为单个补丁决定行动"""
        risk_level = patch.get('risk_level', 'low')
        recommendation = patch.get('recommendation', '常规更新')
        
        # 根据风险等级决定行动
        if risk_level in ['critical', 'high']:
            action = {
                'patch_name': patch.get('name'),
                'action': 'schedule_update',
                'priority': 'high',
                'reason': f"{recommendation} - 风险等级: {risk_level}",
                'requires_approval': True,
                'scheduled_time': None
            }
        elif risk_level == 'medium':
            action = {
                'patch_name': patch.get('name'),
                'action': 'schedule_update',
                'priority': 'medium',
                'reason': recommendation,
                'requires_approval': False,
                'scheduled_time': None
            }
        else:
            action = {
                'patch_name': patch.get('name'),
                'action': 'defer',
                'priority': 'low',
                'reason': f"{recommendation} - 可在下次维护窗口执行",
                'requires_approval': False,
                'scheduled_time': None
            }
        
        return action
    
    def _generate_summary(self, actions, window_suggestion):
        """生成决策摘要"""
        scheduled = [a for a in actions if a['action'] == 'schedule_update']
        deferred = [a for a in actions if a['action'] == 'defer']
        needs_approval = [a for a in scheduled if a.get('requires_approval')]
        
        return {
            'total_actions': len(actions),
            'scheduled_count': len(scheduled),
            'deferred_count': len(deferred),
            'needs_approval': len(needs_approval),
            'suggested_window': window_suggestion,
            'immediate_action_required': len(needs_approval) > 0
        }
    
    def check_update_eligibility(self, last_update_time):
        """检查是否满足更新条件"""
        if not last_update_time:
            return True, "无历史更新记录"
        
        last_update = datetime.fromisoformat(last_update_time.replace('Z', '+00:00'))
        hours_since = (datetime.now() - last_update).total_seconds() / 3600
        
        if hours_since < self.min_interval:
            remaining = int(self.min_interval - hours_since)
            return False, f"距离上次更新仅 {int(hours_since)} 小时，建议等待 {remaining} 小时"
        
        return True, "满足更新条件"
    
    def generate_report(self, decision, patch_data):
        """生成补丁管理报告"""
        report = {
            'report_time': datetime.now().isoformat(),
            'system': patch_data.get('system_info', {}).get('hostname', 'Unknown'),
            'summary': decision['summary'],
            'actions': decision['actions'],
            'recommendations': []
        }
        
        # 添加建议
        if decision['summary']['needs_approval'] > 0:
            report['recommendations'].append(
                f"有 {decision['summary']['needs_approval']} 个关键补丁需要人工审批"
            )
        
        if decision['summary']['suggested_window']:
            window = decision['summary']['suggested_window']
            report['recommendations'].append(
                f"建议更新窗口: {window['recommended_day']} {window['recommended_start']} - {window['recommended_end']}"
            )
        
        return report

# patch_executor.py
import subprocess
import logging
import json
from datetime import datetime
import requests

logger = logging.getLogger(__name__)

class PatchExecutor:
    """补丁执行器"""
    
    def __init__(self, config):
        self.config = config
        self.execution_log = []
        self.rollback_enabled = config.get('rollback_enabled', True)
        self.before_update_hook = config.get('before_update_hook', '')
        self.after_update_hook = config.get('after_update_hook', '')
    
    def execute_update(self, action, dry_run=True):
        """执行补丁更新"""
        result = {
            'patch_name': action.get('patch_name'),
            'action': action.get('action'),
            'status': 'pending',
            'dry_run': dry_run,
            'log': [],
            'timestamp': datetime.now().isoformat()
        }
        
        try:
            # 执行前钩子
            if self.before_update_hook and not dry_run:
                log = self._run_hook(self.before_update_hook, action)
                result['log'].extend(log)
            
            # 执行更新
            if action.get('action') == 'schedule_update':
                update_log = self._perform_update(action, dry_run)
                result['log'].extend(update_log)
                result['status'] = 'success' if not dry_run else 'simulated'
            
            # 执行后钩子
            if self.after_update_hook and not dry_run:
                log = self._run_hook(self.after_update_hook, action)
                result['log'].extend(log)
            
        except Exception as e:
            result['status'] = 'error'
            result['log'].append(f'错误: {str(e)}')
            logger.error(f"补丁 {action.get('patch_name')} 更新失败: {e}")
        
        # 记录执行日志
        self.execution_log.append(result)
        
        return result
    
    def _perform_update(self, action, dry_run):
        """执行实际的补丁更新"""
        log = []
        patch_name = action.get('patch_name')
        
        if dry_run:
            log.append(f"[模拟] 将安装补丁: {patch_name}")
            return log
        
        # 根据操作系统执行不同命令
        os_type = subprocess.getoutput('uname -s')
        
        if os_type == 'Linux':
            # 检测包管理器
            if subprocess.getoutput('which apt-get') == '/usr/bin/apt-get':
                log.extend(self._apt_update(patch_name))
            elif subprocess.getoutput('which yum') == '/usr/bin/yum':
                log.extend(self._yum_update(patch_name))
            elif subprocess.getoutput('which dnf') == '/usr/bin/dnf':
                log.extend(self._dnf_update(patch_name))
        elif os_type == 'Windows':
            log.append("[模拟] Windows 系统补丁更新")
        
        return log
    
    def _apt_update(self, package):
        """Ubuntu/Debian 系统更新"""
        log = []
        try:
            # 模拟更新命令
            log.append(f"执行: apt-get install --only-upgrade {package}")
            # 实际执行:
            # result = subprocess.run(['apt-get', 'install', '--only-upgrade', package], 
            #                        capture_output=True, text=True, timeout=300)
            # log.append(result.stdout)
            # log.append(result.stderr)
        except Exception as e:
            log.append(f"错误: {str(e)}")
        return log
    
    def _yum_update(self, package):
        """RHEL/CentOS 系统更新"""
        log = []
        try:
            log.append(f"执行: yum update {package}")
            # result = subprocess.run(['yum', 'update', package], 
            #                        capture_output=True, text=True, timeout=300)
            # log.append(result.stdout)
        except Exception as e:
            log.append(f"错误: {str(e)}")
        return log
    
    def _dnf_update(self, package):
        """Fedora/RHEL 8+ 系统更新"""
        log = []
        try:
            log.append(f"执行: dnf update {package}")
            # result = subprocess.run(['dnf', 'update', package], 
            #                        capture_output=True, text=True, timeout=300)
            # log.append(result.stdout)
        except Exception as e:
            log.append(f"错误: {str(e)}")
        return log
    
    def _run_hook(self, hook_command, context):
        """执行钩子脚本"""
        log = []
        try:
            result = subprocess.run(
                hook_command.format(**context),
                shell=True,
                capture_output=True,
                text=True,
                timeout=60
            )
            log.append(result.stdout)
            if result.returncode != 0:
                log.append(f"钩子执行失败: {result.stderr}")
        except Exception as e:
            log.append(f"钩子执行错误: {str(e)}")
        return log
    
    def rollback(self, action, reason=""):
        """执行回滚"""
        if not self.rollback_enabled:
            return {'status': 'rollback_disabled'}
        
        log = [f"执行回滚: {action.get('patch_name')}", f"原因: {reason}"]
        
        # 实际回滚逻辑
        # ...
        
        return {'status': 'success', 'log': log}
    
    def get_execution_history(self, limit=50):
        """获取执行历史"""
        return self.execution_log[-limit:]

# intelligent_patch_manager.py
import time
import logging
from datetime import datetime, timedelta
from patch_collector import PatchCollector
from patch_analyzer import PatchAnalyzer
from patch_decision import PatchDecisionEngine
from patch_executor import PatchExecutor

logging.basicConfig(level=logging.INFO)
logger = logging.getLogger(__name__)

class IntelligentPatchManager:
    """AI 驱动的 VPS 智能补丁管理系统"""
    
    def __init__(self, config_path='config.yaml'):
        self.config = self._load_config(config_path)
        self.collector = PatchCollector()
        self.analyzer = PatchAnalyzer()
        self.decision_engine = PatchDecisionEngine(self.config)
        self.executor = PatchExecutor(self.config)
        
        self.last_update_time = None
        self.update_interval = timedelta(hours=self.config.get('check_interval_hours', 24))
    
    def _load_config(self, path):
        """加载配置文件"""
        import yaml
        try:
            with open(path, 'r', encoding='utf-8') as f:
                return yaml.safe_load(f)
        except:
            return {
                'check_interval_hours': 24,
                'min_update_interval_hours': 24,
                'max_concurrent_updates': 1,
                'auto_approved_levels': ['low', 'medium'],
                'rollback_enabled': True
            }
    
    def run_check_cycle(self):
        """执行一次完整的补丁检查周期"""
        logger.info("=" * 60)
        logger.info(f"开始补丁检查周期 - {datetime.now().isoformat()}")
        
        # 1. 数据采集
        logger.info("步骤 1: 采集系统补丁信息...")
        patch_data = self.collector.collect_all()
        logger.info(f"  发现 {len(patch_data.get('available_patches', []))} 个可用补丁")
        logger.info(f"  安全补丁: {len(patch_data.get('security_patches', []))} 个")
        
        # 2. AI 分析
        logger.info("步骤 2: AI 智能分析补丁...")
        analysis = self.analyzer.analyze_patches(patch_data)
        logger.info(f"  关键补丁: {analysis['critical_count']} 个")
        logger.info(f"  高风险补丁: {analysis['high_count']} 个")
        
        # 3. 风险预测
        logger.info("步骤 3: 预测更新风险...")
        risk_prediction = self.analyzer.predict_update_risk(patch_data)
        logger.info(f"  风险等级: {risk_prediction['risk_level']}")
        logger.info(f"  建议: {risk_prediction['reason']}")
        
        # 4. 生成决策
        logger.info("步骤 4: 生成更新决策...")
        window_suggestion = self.analyzer.suggest_update_window(patch_data)
        decision = self.decision_engine.make_decision(
            analysis, risk_prediction, window_suggestion
        )
        logger.info(f"  需要安排的补丁: {decision['summary']['scheduled_count']} 个")
        logger.info(f"  需要审批: {decision['summary']['needs_approval']} 个")
        
        # 5. 检查更新条件
        eligible, reason = self.decision_engine.check_update_eligibility(
            self.last_update_time
        )
        logger.info(f"  更新条件: {reason}")
        
        # 6. 执行更新（仅在有权限且满足条件时）
        if eligible and decision['summary']['scheduled_count'] > 0:
            logger.info("步骤 5: 执行补丁更新...")
            
            for action in decision['actions']:
                if action['action'] == 'schedule_update' and not action.get('requires_approval'):
                    result = self.executor.execute_update(action, dry_run=False)
                    logger.info(f"  补丁 {action['patch_name']}: {result['status']}")
                    
                    if result['status'] == 'success':
                        self.last_update_time = datetime.now().isoformat()
        
        # 7. 生成报告
        report = self.decision_engine.generate_report(decision, patch_data)
        logger.info("步骤 6: 生成管理报告")
        
        # 保存报告
        report_path = f"/var/log/patch-manager/report_{datetime.now().strftime('%Y%m%d_%H%M%S')}.json"
        with open(report_path, 'w', encoding='utf-8') as f:
            json.dump(report, f, indent=2, ensure_ascii=False)
        
        logger.info(f"  报告已保存: {report_path}")
        logger.info("周期完成")
        logger.info("=" * 60)
        
        return report
    
    def run_continuous(self, interval_hours=24):
        """持续运行补丁管理系统"""
        logger.info("启动智能补丁管理系统")
        logger.info(f"检查间隔: {interval_hours} 小时")
        
        while True:
            try:
                self.run_check_cycle()
            except Exception as e:
                logger.error(f"周期执行失败: {e}", exc_info=True)
            
            time.sleep(interval_hours * 3600)

if __name__ == "__main__":
    # 配置示例
    config = {
        'check_interval_hours': 24,
        'min_update_interval_hours': 24,
        'max_concurrent_updates': 1,
        'auto_approved_levels': ['low', 'medium'],
        'rollback_enabled': True,
        'before_update_hook': 'docker commit $(hostname) backup-before-update',
        'after_update_hook': 'docker ps --filter "status=running" | wc -l'
    }
    
    manager = IntelligentPatchManager()
    manager.config = config
    manager.run_continuous(interval_hours=24)

# 创建虚拟环境
python3 -m venv venv
source venv/bin/activate

# 安装依赖
pip install psutil pyyaml requests numpy scikit-learn

# 创建配置目录
mkdir -p /etc/patch-manager
mkdir -p /var/log/patch-manager
mkdir -p /var/lib/patch-manager/reports

# 系统配置
system:
  check_interval_hours: 24
  max_concurrent_updates: 1
  
# AI 分析配置
analysis:
  risk_factors:
    cve_severity: 0.3
    exploit_available: 0.25
    system_criticality: 0.2
    patch_type: 0.15
    historical_success: 0.1
  
# 执行配置
execution:
  min_update_interval_hours: 24
  auto_approved_levels: ["low", "medium"]
  rollback_enabled: true
  
  # 更新前钩子（创建备份）
  before_update_hook: "docker commit $(hostname) backup-before-update"
  
  # 更新后钩子（验证服务状态）
  after_update_hook: "docker ps --filter 'status=running' | wc -l"
  
# 通知配置
notifications:
  enabled: true
  channels:
    - type: email
      to: "admin@example.com"
    - type: webhook
      url: "https://hooks.example.com/patch-alerts"

# 创建 systemd 服务
sudo nano /etc/systemd/system/patch-manager.service

# 服务文件内容：
[Unit]
Description=AI-Powered Intelligent Patch Manager
After=network.target

[Service]
Type=simple
User=root
WorkingDirectory=/opt/patch-manager
ExecStart=/opt/patch-manager/venv/bin/python intelligent_patch_manager.py
Restart=always
RestartSec=10
StandardOutput=journal
StandardError=journal

[Install]
WantedBy=multi-user.target

# 启动服务
sudo systemctl daemon-reload
sudo systemctl enable patch-manager
sudo systemctl start patch-manager

# 查看状态
sudo systemctl status patch-manager

# 查看日志
journalctl -u patch-manager -f

# patch_dashboard.py
import json
import matplotlib.pyplot as plt
from datetime import datetime, timedelta

def generate_patch_dashboard(history_data):
    """生成本地补丁管理仪表盘"""
    
    fig, axes = plt.subplots(2, 2, figsize=(14, 10))
    
    # 1. 补丁状态分布
    ax1 = axes[0, 0]
    if history_data:
        latest = history_data[-1]
        labels = ['Critical', 'High', 'Medium', 'Low']
        sizes = [
            latest.get('critical_count', 0),
            latest.get('high_count', 0),
            latest.get('medium_count', 0),
            latest.get('low_count', 0)
        ]
        colors = ['#ff4444', '#ff8800', '#ffcc00', '#44cc44']
        ax1.pie(sizes, labels=labels, colors=colors, autopct='%1.1f%%')
    ax1.set_title('Patch Risk Distribution')
    
    # 2. 更新成功率趋势
    ax2 = axes[0, 1]
    if len(history_data) > 1:
        dates = [d['timestamp'][:10] for d in history_data[-30:]]
        success_rates = [d.get('success_rate', 0) for d in history_data[-30:]]
        ax2.plot(dates, success_rates, 'b-', linewidth=2)
        ax2.set_title('Update Success Rate Trend (Last 30 Days)')
        ax2.set_xlabel('Date')
        ax2.set_ylabel('Success Rate (%)')
        ax2.grid(True, alpha=0.3)
    
    # 3. 补丁类型分布
    ax3 = axes[1, 0]
    if history_data:
        latest = history_data[-1]
        types = list(latest.get('patch_types', {}).keys())
        counts = list(latest.get('patch_types', {}).values())
        ax3.bar(types, counts, color='steelblue')
        ax3.set_title('Patches by Type')
        ax3.set_xlabel('Type')
        ax3.set_ylabel('Count')
        ax3.tick_params(axis='x', rotation=45)
    
    # 4. 关键指标
    ax4 = axes[1, 1]
    ax4.axis('off')
    if history_data:
        latest = history_data[-1]
        metrics = [
            f"Total Patches: {latest.get('total_patches', 0)}",
            f"Security Patches: {latest.get('security_patches', 0)}",
            f"Critical: {latest.get('critical_count', 0)}",
            f"Update Rate: {latest.get('update_success_rate', 0):.1f}%",
            f"Last Update: {latest.get('last_update_time', 'N/A')[:10]}"
        ]
        ax4.text(0.1, 0.8, '\n'.join(metrics), fontsize=12, 
                transform=ax4.transAxes, va='top')
    ax4.set_title('Key Metrics')
    
    plt.tight_layout()
    plt.savefig('/var/log/patch-manager/dashboard.png', dpi=150)
    plt.close()

# 告警规则
alerts:
  critical_patch_missing:
    condition: "critical_count > 0"
    notification:
      - email: "security@example.com"
      - slack: "#security-alerts"
    severity: "critical"
  
  update_failure:
    condition: "failure_rate > 0.1"
    notification:
      - email: "ops@example.com"
    severity: "high"
  
  compliance_drift:
    condition: "patches_missing > 5 and days_since_last_update > 7"
    notification:
      - email: "compliance@example.com"
      - webhook: "https://compliance.example.com/api/alerts"
    severity: "medium"

# 常见问题处理策略
TROUBLESHOOTING = {
    'update_failed': {
        'steps': [
            '检查系统日志',
            '验证网络连接',
            '检查磁盘空间',
            '尝试手动更新',
            '执行回滚'
        ],
        'auto_retry': True,
        'max_retries': 3
    },
    'conflict_detected': {
        'steps': [
            '识别冲突补丁',
            '查询兼容性数据库',
            '安排分步更新',
            '更新依赖包'
        ],
        'auto_retry': False
    },
    'service_disruption': {
        'steps': [
            '立即回滚更新',
            '检查服务状态',
            '重启受影响服务',
            '通知相关人员'
        ],
        'auto_retry': False
    }
}