|
From: | sven falempin |
Subject: | Re: Monitor Ossec |
Date: | Tue, 24 Sep 2013 10:52:01 -0400 |
frwa onto [24.09.2013 11:48]:
> Dear Jaro,It should read "check process..." instead of "check program..."
> Here it is
>
> check program OSSEC with path "/usr/bin/test_ossec" with timeout 1000
> seconds
> if status != 0 then restart
> start program = "/etc/init.d/ossec_server start" with timeout 60 seconds
> stop program = "/etc/init.d/ossec_server stop"
> group server
Well, you should replace "/etc/init.d/ossec_server start" with the
> Another thing I have check is that I dont have /etc/init.d/ossec_server
> start or stop but just this one file ossec_hids
command that really starts and stops the software.
Jaroslaw only gave a pattern you could use, but you should fill in
correct values. And you still are allowed to look up man pages :-) There
is a section "PROGRAM STATUS TESTING" on "man monit".
This script does not contain those few lines only, does it? There must
> vi ossec-hids
> stop)
> stop
> ;;
> status)
> rh_status
> ;;
> restart)
> restart
> ;;
> condrestart)
> if [ -e /var/lock/subsys/$SHORT ]; then restart; fi
> ;;
> reload)
> reload
> ;;
> *)
> echo $"Usage: ossec-hids
> {start|stop|status|restart|condrestart|reload}"
> exit 1
> esac
>
> exit $RETVAL
be functions and variables defined in the script. If this script is
intended to start and stop OSSEC, the lines in /etc/monit.d/ossec.conf
should read
start program = "/etc/init.d/ossec-hids start" with timeout 60 seconds
stop program = "/etc/init.d/ossec-hids stop"
[Prev in Thread] | Current Thread | [Next in Thread] |