On Wed, Apr 19, 2017 at 3:23 PM, Tony Bryant <cspitr....@gmail.com> wrote: > Yes test.sh is on the agent. Execd is also running and yep the alert is > firing. >
Try removing the level option and leave just the rules_id. > On Wednesday, April 19, 2017 at 11:30:37 AM UTC-7, dan (ddpbsd) wrote: >> >> On Wed, Apr 19, 2017 at 2:26 PM, Tony Bryant <cspit...@gmail.com> wrote: >> > Hello, >> > >> > I'm pretty new to OSSEC and I'm working to get some active responses >> > working. I have tried a number of different active responses but cannot >> > seem >> > to get it to work anywhere (not on the server or agents). I'm now trying >> > a >> > simple AR to just log to active-responses.log but it still does not seem >> > to >> > be triggering. I do receive the email alert, but the AR does not >> > trigger. >> > Here is my config for the test active response: >> > >> > <command> >> > >> > <name>test</name> >> > >> > <executable>test.sh</executable> >> > >> > <expect></expect> >> > >> > <timeout_allowed>no</timeout_allowed> >> > >> > </command> >> > >> > (I've tried the location as local, all, and server but no luck) >> > >> > <active-response> >> > >> > <disabled>no</disabled> >> > >> > <command>test</command> >> > >> > <location>local</location> >> > >> > <rules_id>70999</rules_id> >> > >> > <level>0</level> >> > >> > </active-response> >> > >> > >> > >> > #!/bin/sh >> > >> > ACTION=$1 >> > USER=$2 >> > IP=$3 >> > ALERTID=$4 >> > RULEID=$5 >> > >> > LOCAL=`dirname $0`; >> > cd $LOCAL >> > cd ../ >> > PWD=`pwd` >> > >> > >> > # Logging the call >> > echo "`date` $0 $1 $2 $3 $4 $5 $6 $7 $8" >> >> > ${PWD}/../logs/active-responses.log >> > >> > >> > >> > The permissions on test.sh are correct with execute permission and I >> > added >> > them to ossec group as all other ARs seemed to have that. >> > >> >> Is test.sh on the system you're trying to run the AR on? >> Is execd running on the system you're trying to run the AR on? >> Is 70999 firing? >> With rules_id, I don't think you'll need the level option set. >> >> > >> > Thanks! >> > >> > >> > >> > >> > >> > >> > >> > >> > >> > >> > >> > >> > >> > >> > >> > >> > >> > >> > >> > >> > </active-response> >> > >> > >> > -- >> > >> > --- >> > You received this message because you are subscribed to the Google >> > Groups >> > "ossec-list" group. >> > To unsubscribe from this group and stop receiving emails from it, send >> > an >> > email to ossec-list+...@googlegroups.com. >> > For more options, visit https://groups.google.com/d/optout. > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to ossec-list+unsubscr...@googlegroups.com. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.