Here's a shell script that will take an OSSEC alert and convert it to a
Nagios passive service event.
Install the script as an Active Response handler, then add a passive
service check in Nagios for all the hosts that have OSSEC agents. The
agent name must match the Nagios host name. Currently, the script
requires OSSEC and Nagios to be running on the same server.
I like funneling events through the Nagios notification system for a
couple of reasons: 1) Nagios' notification system is far more
sophisticated; 2) All notification configuration is handled in one
place; 3) Because ISP's are trying to defeat spamming, more are are
requiring SMTP traffic to be authenticated and/or use non-standard
ports, and OSSEC doesn't not provide this configurability (that I've seen).
Enjoy.
- Dave Stycos
#!/bin/sh
#
# Submits an OSSEC alert as a passive service check result to nagios.
# NOTE: Will only run if nagios and ossec server run on the same machine.
#
# Author: Dave Stycos
#
# This script is Public Domain, and is provided AS-IS. There is no
# warranty, and no support given for its contents.
#
# Version 1.0: Dec. 12, 2009
#
ACTION=$1
USER=$2
IP=$3
ALERTID=$4
RULEID=$5
LOCAL=`dirname $0`;
cd $LOCAL
cd ../
PWD=`pwd`
UNAME=`uname`
# Change these as necessary to match your Nagios installation.
NagiosHome=/usr/local/nagios
NagiosCommandFile=${NagiosHome}/var/rw/nagios.cmd
# All alerts will be processed by Nagios under this service.
NagiosServiceName=OSSEC
# If an alert level is equal to or greater than this level, Nagios
# will consider it a critical error, else it will be a warning.
NagiosCriticalLevel=10
# Check that nagios command file exists.
if [ ! -w $NagiosCommandFile ]; then
logger -p local0.err "$0: File $NagiosCommandFile not found. Exiting."
exit 1
fi
# Getting alert time
ALERTTIME=`echo "$ALERTID" | cut -d "." -f 1`
# Getting end of alert
ALERTLAST=`echo "$ALERTID" | cut -d "." -f 2`
# Getting full alert
ALERTTEXT=`grep -A 10 "$ALERTTIME" $PWD/../logs/alerts/alerts.log | grep -v
".$ALERTLAST: " -A 10 `
# Extract host (agent) name from alert.
HOSTNAME=`echo "$ALERTTEXT" | sed -n
'2,2s/^.*\:[0-9][0-9]\:[0-9][0-9][^A-Za-z0-9_]*\([A-Za-z0-9_]*\).*$/\1/p'`
# Extract alert level from alert.
ALERTLVL=`echo "$ALERTTEXT" | sed -n '3,3s/^.*(level \([0-9]*\).*$/\1/p'`
# Extract description from alert.
ALERTMSG=`echo "$ALERTTEXT" | sed -n '6,6p'`
# If the alert level is above a threshold, tell Nagios this is critical.
# Else consider this a warning.
if [ $ALERTLVL -ge $NagiosCriticalLevel ]; then
NagiosReturnCode=2
else
NagiosReturnCode=1
fi
# Send passive result to Nagios for logging and notification alerts.
datetime=`date +%s`
cmdline="[$datetime]
PROCESS_SERVICE_CHECK_RESULT;$HOSTNAME;$NagiosServiceName;$NagiosReturnCode;$ALERTMSG"
`echo $cmdline >> $NagiosCommandFile`
