I just tried this on my OpenBSD systems (running MASTER from github),
and it's working fine:
##############AGENT#################################
In the agent's ossec.conf:
<localfile>
<log_format>full_command</log_format>
<command>/usr/sbin/rcctl check ntpd</command>
<frequency>60</frequency>
<alias>ntpcheck</alias>
</localfile>
Script on the agent:
# more /var/ossec/active-response/bin/restart-ntp.sh
#!/bin/sh
/usr/sbin/rcctl start ntpd
echo 'restarting ntpd' >> /var/ossec/logs/active-responses.log
####################################################
##############SERVER###############################
ossec.conf:
<command>
<name>restart-ntp</name>
<executable>restart-ntp.sh</executable>
<expect></expect>
</command>
<active-response>
<command>restart-ntp</command>
<location>local</location>
<rules_id>700002</rules_id>
</active-response>
local_rules.xml:
<rule id="700002" level="2">
<if_sid>530</if_sid>
<match>ossec: output: 'ntpcheck':</match>
<check_diff />
<description>ntpd failed</description>
</rule>
######################################################
This totally ignores the fact there may be "FAILED" to "OK" status changes.
I'm also not a fan of restarting service automatically. A failed
service should be investigated. I also think this is more of a job for
nagios or similar products.
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
