Hi all,
I'm having problems with my internet connection, and have used syslog
to log the events everytime my router drops LCP. I wanted to run a
script on one of my client machines when this event occurs.
I created the bash script to do what I wanted, and made sure it ran
under the correct user permissions. I copied it to /var/ossec/active-
response/bin on both the server and the client in question (as I
wasn't sure which one needed it). I also set it to executable.
I added:
<command>
<name>restart-nzbperl</name>
<executable>restart-nzbperl</executable>
<expect></expect>
<timeout_allowed>no</timeout_allowed>
</command>
and:
<active-response>
<command>restart-nzbperl</command>
<location>defined-agent</location>
<agent_id>001</agent_id>
<rules_id>100101</rules_id>
</active-response>
to the ossec.conf on the server.
The rule that executes when I have an LCP down event is 100101, and
definitely works as I get the alert e-mail defined for that rule. The
script doesn't run (or at least I assume it doesn't) and there are no
entries in log files on both the server nor the client indicating that
the script attempted to run.
Am I missing something obvious?
Any help appreciated.
Thanks,
Steve
