Re: Monitor Ossec

[sven falempin]

I may sound rude, but

I do not see any relation with monit.

You all sound like a commercial for OSSEC. And this is BAD advertising.

On Tue, Sep 24, 2013 at 6:11 AM, Werner Flamme <address@hidden> wrote:

frwa onto [24.09.2013 11:48]:

> Dear Jaro,
>               Here it is
>
> check program OSSEC with path "/usr/bin/test_ossec" with timeout 1000
> seconds
>        if status != 0 then restart
> start program = "/etc/init.d/ossec_server start" with timeout 60 seconds
> stop program = "/etc/init.d/ossec_server stop"
> group server

It should read "check process..." instead of "check program..."

> Another thing I have check is that I dont have /etc/init.d/ossec_server
> start or stop but just this one file ossec_hids

Well, you should replace "/etc/init.d/ossec_server start" with the
command that really starts and stops the software.

Jaroslaw only gave a pattern you could use, but you should fill in
correct values. And you still are allowed to look up man pages :-) There
is a section "PROGRAM STATUS TESTING" on "man monit".

> vi ossec-hids
>         stop)
>           stop
>           ;;
>         status)
>           rh_status
>           ;;
>         restart)
>           restart
>           ;;
>         condrestart)
>           if [ -e /var/lock/subsys/$SHORT ]; then restart; fi
>           ;;
>         reload)
>           reload
>           ;;
>         *)
>           echo $"Usage: ossec-hids
> {start|stop|status|restart|condrestart|reload}"
>           exit 1
> esac
>
> exit $RETVAL

This script does not contain those few lines only, does it? There must
be functions and variables defined in the script. If this script is
intended to start and stop OSSEC, the lines in /etc/monit.d/ossec.conf
should read

start program = "/etc/init.d/ossec-hids start" with timeout 60 seconds
stop program = "/etc/init.d/ossec-hids stop"

--
To unsubscribe:
https://lists.nongnu.org/mailman/listinfo/monit-general

--

---------------------------------------------------------------------------------------------------------------------
() ascii ribbon campaign - against html e-mail 
/\