[prev in list] [next in list] [prev in thread] [next in thread] 

List:       ossec-list
Subject:    Re: [ossec-list] Re: Ossec active response on agent
From:       "dan (ddp)" <ddpbsd () gmail ! com>
Date:       2016-07-27 16:33:26
Message-ID: CAMyQvMpsZVvTPhpUCMW-O1QU9jJCC7gZJfFPpNepFTdX_LHK=A () mail ! gmail ! com
[Download RAW message or body]

I just tried this on my OpenBSD systems (running MASTER from github),
and it's working fine:


##############AGENT#################################
In the agent's ossec.conf:
  <localfile>
    <log_format>full_command</log_format>
    <command>/usr/sbin/rcctl check ntpd</command>
    <frequency>60</frequency>
    <alias>ntpcheck</alias>
  </localfile>

Script on the agent:
# more /var/ossec/active-response/bin/restart-ntp.sh
#!/bin/sh

/usr/sbin/rcctl start ntpd

echo 'restarting ntpd' >> /var/ossec/logs/active-responses.log
####################################################



##############SERVER###############################

ossec.conf:
  <command>
    <name>restart-ntp</name>
    <executable>restart-ntp.sh</executable>
    <expect></expect>
  </command>

  <active-response>
    <command>restart-ntp</command>
    <location>local</location>
    <rules_id>700002</rules_id>
  </active-response>


local_rules.xml:
  <rule id="700002" level="2">
    <if_sid>530</if_sid>
    <match>ossec: output: 'ntpcheck':</match>
    <check_diff />
    <description>ntpd failed</description>
  </rule>
######################################################


This totally ignores the fact there may be "FAILED" to "OK" status changes.
I'm also not a fan of restarting service automatically. A failed
service should be investigated. I also think this is more of a job for
nagios or similar products.

-- 

--- 
You received this message because you are subscribed to the Google Groups \
"ossec-list" group. To unsubscribe from this group and stop receiving emails from it, \
send an email to ossec-list+unsubscribe@googlegroups.com. For more options, visit \
https://groups.google.com/d/optout.


[prev in list] [next in list] [prev in thread] [next in thread]