Hi Steve, Did you look at /var/ossec/logs/active-response.log on the agent side? Did you actually included any logging on your script? That's where this information get stored. Also, you can try running your script manually to see if it works:
/var/ossec/active-response/bin/restart-nzbperl add test test test *one thing to note is that if the client/server connection is down, the agent may not get the information from the server to run the response... Thanks, -- Daniel B. Cid dcid ( at ) ossec.net On Wed, Jul 9, 2008 at 12:07 PM, Steve <[EMAIL PROTECTED]> wrote: > > Hi all, > > I'm having problems with my internet connection, and have used syslog > to log the events everytime my router drops LCP. I wanted to run a > script on one of my client machines when this event occurs. > > I created the bash script to do what I wanted, and made sure it ran > under the correct user permissions. I copied it to /var/ossec/active- > response/bin on both the server and the client in question (as I > wasn't sure which one needed it). I also set it to executable. > > I added: > > <command> > <name>restart-nzbperl</name> > <executable>restart-nzbperl</executable> > <expect></expect> > <timeout_allowed>no</timeout_allowed> > </command> > > and: > > <active-response> > <command>restart-nzbperl</command> > <location>defined-agent</location> > <agent_id>001</agent_id> > <rules_id>100101</rules_id> > </active-response> > > to the ossec.conf on the server. > > The rule that executes when I have an LCP down event is 100101, and > definitely works as I get the alert e-mail defined for that rule. The > script doesn't run (or at least I assume it doesn't) and there are no > entries in log files on both the server nor the client indicating that > the script attempted to run. > > Am I missing something obvious? > > Any help appreciated. > > Thanks, > > Steve >
