[ossec-list] Getting active response to work, what am I missing?

[John Lewis]

I have an agent installed on an internet facing system, and am trying to get
active response working for it.

 

Here's what I have in the agent's ossec.conf file, AND the server's
ossec.conf:

  <command>

    <name>host-deny</name>

    <executable>host-deny.sh</executable>

    <expect>srcip</expect>

    <timeout_allowed>yes</timeout_allowed>

  </command>

 

  <active-response>

    <command>host-deny</command>

    <location>local</location>

    <level>10</level>

    <rules_id>5551,5720</rules_id>

    <timeout>600</timeout>

  </active-response>

 

Rules 5551 and 5720 are kicking off at level 10 for that agent, and nothing
is happening.

 

What am I missing?  I don't see anything unusual in logs/ossec.log