Dear Jaro,
Here it is
check program OSSEC with path "/usr/bin/test_ossec" with timeout 1000
seconds
if status != 0 then restart
start program = "/etc/init.d/ossec_server start" with timeout 60 seconds
stop program = "/etc/init.d/ossec_server stop"
group server
Another thing I have check is that I dont have /etc/init.d/ossec_server start or stop but just this one file ossec_hids
vi ossec-hids
stop)
stop
;;
status)
rh_status
;;
restart)
restart
;;
condrestart)
if [ -e /var/lock/subsys/$SHORT ]; then restart; fi
;;
reload)
reload
;;
*)
echo $"Usage: ossec-hids {start|stop|status|restart|condrestart|reload}"
exit 1
esac
exit $RETVAL