Hi,
i would like to do something special, but i dont know if it works and
if yes, how it works.
i would like to create an active response script that sends messages
to nagios monitoring software.
this works to 80%.
at the moment this works like this.
ossec.conf:
<command>
<name>nagios</name>
<executable>nagios.sh</executable>
<timeout_allowed>no</timeout_allowed>
<expect></expect>
</
command>
<!-- Active Response Config -->
<active-response>
<command>nagios</command>
<location>local</location>
<rules_id>110011</rules_id>
</active-response>
rule 110011:
<group name="nagios,">
<rule id="110010" level="0">
<decoded_as>nagios</decoded_as>
<description>nagios rules</description>
</rule>
<rule id="110011" level="12">
<if_sid>110010</if_sid>
<match>Directory index forbidden by rule</match>
<description>Attempt to access forbidden directory index.</
description>
<group>access_denied,</group>
</rule>
</group>
(this is a testrule for apache and works)
this script is triggered when rule 110010 is hit (nagios.sh):
#!/bin/sh
NAGIOS_SERVER=10.10.150.10
NG_SERVICE_HOST=`hostname -s`
/bin/echo -e "$NG_SERVICE_HOST\tOSSEC\t2\tRC=1 MSG=TEST\n" | /var/
ossec/active-response/bin/send_nsca 10.10.150.10 -c /var/ossec/active-
response/bin/nagios.c
fg
this creates a nagios message with RC=1 and MSG=TEST
----
i now would like to have that "MSG" is a variable.
this is the alert.log output
--
** Alert 1207566756.158459: - nagios,access_denied,
2008 Apr 07 13:12:36 (th-office) 10.10.100.55->/var/log/apache2/
error.log
Rule: 110011 (level 12) -> 'Attempt to access forbidden directory
index.'
Src IP: (none)
User: (none)
[Mon Apr 07 13:12:36 2008] [error] [client 10.10.100.44] Directory
index forbidden by rule: /var/www/
---
i would like to put the <match>Directory index forbidden by rule</
match> (here: Directory index forbidden by rule: /var/www/) from the
rule in a variable and "send" it to the script as $4 for example.
Then i could send the log message because of the rule is fired into
nagios and do not have to set it in the script itself, but i only
found to give the script an action, srcip or user.
I hope you understand what i mean.
Is it possible to do that?
Kind regards and thanks
Sebastian
