Solved. Permissions are 550 root:ossec but the problem is due to editor. I using server panel online editor (Plesk) which inserts extra ctrl char no visibles in code, changing editor solve the problem.
Thank you very much. El lunes, 10 de junio de 2013 15:08:24 UTC+2, dan (ddpbsd) escribió: > > On Mon, Jun 10, 2013 at 5:16 AM, Ubertino Da Casale > <[email protected] <javascript:>> wrote: > > Good morning, > > OSSEC 2.7 > > Centos 6 > > Plesk 11 > > > > Trying to test active-response: > > > > Rule created and working: 100005, group spam, level 13 > > File /var/ossec/active-response/bin/test.sh duplicates restart-ossec.sh, > > root:ossec 550 > > > > Command: > > > > <command> > > <name>test-ar</name> > > <executable>test.sh</executable> > > <expect /> > > <timeout_allowed>no</timeout_allowed> > > </command> > > > > Active-response: > > > > <active-response> > > <disabled>no</disabled> > > <command>test-ar</command> > > <location>local</location> > > <level>13</level> > > <rules_id>100005</rules_id> > > </active-response> > > > > Don't work: > > > > ossec.log ossec-execd(1312): ERROR: Error executing > > '/var/ossec/active-response/bin/test.sh': No such file or directory (but > > file exists) > > active-responses.log: no entry > > > > If change command executable to restart-ossec.sh works fine. Why? > > > > Thank you. > > > > > What are the permissions of /var/ossec/active-response/bin/test.sh on the > agent? > > > > > -- > > > > --- > > You received this message because you are subscribed to the Google > Groups > > "ossec-list" group. > > To unsubscribe from this group and stop receiving emails from it, send > an > > email to [email protected] <javascript:>. > > For more options, visit https://groups.google.com/groups/opt_out. > > > > > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
