Try changing your script to be: #!/bin/sh echo `date` >> /home/jlee/badip.log
________________________________________ From: jplee3 [[email protected]] Sent: Monday, December 07, 2009 13:53 To: ossec-list Subject: [ossec-list] Help w/ Active Response! Hi all, I'm testing an Active Response script but keep getting this in the ossec.log: 2009/12/07 10:45:08 ossec-execd(1312): ERROR: Error executing '/var/ ossec/active-response/bin/bad-ip.sh': Exec format error The script that I'm just trying to get working is this: echo `date` >> /home/jlee/badip.log Eventually I want to append the IP but all I'm doing here [as a test to see if things are even working] is appending the current date to badip.log whenever rule 5720 is triggered. Is there something else that *always* needs to be in these .sh scripts? If I run this script on it's own it seems to work just fine. In the ossec.conf I have the following; <command> <name>bad-ip</name> <executable>bad-ip.sh</executable> <expect>user, srcip</expect> <timeout_allowed>no</timeout_allowed> </command> <active-response> <disabled>no</disabled> <command>bad-ip</command> <location>local</location> <rules_id>5720</rules_id> <rules_group>authentication_failures</rules_group> </active-response> Thanks
