I think that the feature that you are asking for is not supported, buuuuut, you can modify the scritp that you are running with cron to log a line, with logger, when it starts, so, then with ossec you can correlate that entry with the finished one....
CHeers! Nico On Mon, 2007-02-05 at 10:28 -0500, Mark Haney wrote: > Is it possible for me to set a rule up to trigger if a particular log > entry was NOT logged inside a time frame? > > I want to test for the starting and stopping of a cron job. I have all > the rules in place for all the log entries it will generate, but I want > to be able to test to for the lack of a 'finished' log entry between say > midnight to 11:59pm. Is this possible? Or is there a work around to > make it possible? > >
