On Mon, Jun 10, 2013 at 5:16 AM, Ubertino Da Casale <[email protected]> wrote: > Good morning, > OSSEC 2.7 > Centos 6 > Plesk 11 > > Trying to test active-response: > > Rule created and working: 100005, group spam, level 13 > File /var/ossec/active-response/bin/test.sh duplicates restart-ossec.sh, > root:ossec 550 > > Command: > > <command> > <name>test-ar</name> > <executable>test.sh</executable> > <expect /> > <timeout_allowed>no</timeout_allowed> > </command> > > Active-response: > > <active-response> > <disabled>no</disabled> > <command>test-ar</command> > <location>local</location> > <level>13</level> > <rules_id>100005</rules_id> > </active-response> > > Don't work: > > ossec.log ossec-execd(1312): ERROR: Error executing > '/var/ossec/active-response/bin/test.sh': No such file or directory (but > file exists) > active-responses.log: no entry > > If change command executable to restart-ossec.sh works fine. Why? > > Thank you. >
What are the permissions of /var/ossec/active-response/bin/test.sh on the agent? > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/groups/opt_out. > > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
