I got a script at timed intervals pinging out a server list and only
writing failures to a log like so: ( this is a test run using unknown
machine name )
PINGSERV PING FAILURE 06/03/2016 8:40:48.35 fail1
Now I have set up decoders like so:
<decoder name="pingserv">
<prematch>^PINGSERV PING </prematch>
</decoder>
<decoder name="pingserv-fail">
<parent>pingserv</parent>
<regex offset="after_parent">(\w+) (\d\d/\d\d/\d\d\d\d
\d:\d\d:\d\d.\d\d) (\w+)</regex>
<order>action,extra_data,dstip</order>
</decoder>
The output is as such ( more and less what I want )
PINGSERV PING FAILURE 06/03/2016 8:40:48.35 fail1
**Phase 1: Completed pre-decoding.
full event: 'PINGSERV PING FAILURE 06/03/2016 8:40:48.35 fail1 '
hostname: 'alamo'
program_name: '(null)'
log: 'PINGSERV PING FAILURE 06/03/2016 8:40:48.35 fail1 '
**Phase 2: Completed decoding.
decoder: 'pingserv'
action: 'FAILURE'
extra_data: '06/03/2016 8:40:48.35'
dstip: 'fail1'
**Phase 3: Completed filtering (rules).
Rule id: '1002'
Level: '2'
Description: 'Unknown problem somewhere in the system.'
**Alert to be generated.
The issue is that I am not able to trigger the rule bellow:
<group name="ping-servers">
<rule id="100010" level="0">
<decoded_as>pingserv</decoded_as>
<description>Grouping For Server Ping Group</description>
</rule>
</group>
On Thursday, June 2, 2016 at 6:48:13 AM UTC-5, Jacob Mcgrath wrote:
>
> Was wondering on the best route/option to accomplish this?
>
>
> (similar to the USB storage detection)
>
> Was thinking about a batch or bash that would ping servers from a list to
> a file. That every so many minute this
> file would be overwritten with the new results.
>
> If the results "differ" from the last log the alert would be triggered.
>
>
> (other option)
>
> Run script as scheduled task, write to log then monitor log like a syslog.
> Regex for the failed pings. Then alerts.
>
>
> Curious if any had tried and found either way better?
>
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to ossec-list+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
