Hi Folks; A simple rule change to alert on these errors in the system log did the trick. FYI I used taskkill to force a stop on the Apache service against the PID reported in taskmanager.
Cheers, Troy ________________________________ From: T STONE <[email protected]> To: "[email protected]" <[email protected]> Sent: Friday, September 14, 2012 8:18 PM Subject: Re: [ossec-list] Trying to monitor Apache - any way to see if Apache becomes unresponsive or the service fails? I've noticed in the system log there are entries for start, stop, and "stopped unexpectedly" where apache is concerned. For my needs at this point, emailing specific people when anything apache shows up in the event log might just suffice. Thanks Jer! t ________________________________ From: Jeremy Lee <[email protected]> To: [email protected] Sent: Friday, September 14, 2012 4:52 PM Subject: Re: [ossec-list] Trying to monitor Apache - any way to see if Apache becomes unresponsive or the service fails? I stand corrected, you could actually leverage OSSEC process monitoring: http://www.ossec.net/doc/manual/monitoring/process-monitoring.html So you should be able to plug a curl right in as a command to monitor. You could also run something like `service httpd status` Of course, this probably won't catch any other anomalies like a hardware firewall or router that might be blocking traffic (i.e. if external clients are unable to reach the server). On Fri, Sep 14, 2012 at 4:48 PM, Jeremy Lee <[email protected]> wrote: There are probably many ways to do this. You could, for instance, run curl (http://beerpla.net/2010/06/10/how-to-display-just-the-http-response-code-in-cli-curl/) as a cronjob that checks the site every X minutes and outputs to a log that OSSEC is monitoring. > > >I don't recall if there is a way to do this more 'natively' in OSSEC, which I >think would be most preferred. > > > >On Fri, Sep 14, 2012 at 4:27 PM, tstoneami <[email protected]> wrote: > >Hi folks; >> >>I have monitoring and email notifications working for 3rd party logs on my >>Windows server. >> >>On this same server, Apache/Tomcat is installed. I need to alert if the >>Apache service fails or becomes unresponsive. I have found several self >>contained solutions, but would love to also be able to do this with OSSEC. >> >>Any input appreciated. >> >>Many Thanks, >> >>Troy >> >> >
