Not tested this, but you could potentially use the agentless monitoring system....
Set up an ssh_generic_diff for each host with the arguments: > /var/ossec/bin/ossec-control status Then you'll get an alert when the status of any process changes. I am not sure if this will generate false positives however. (may need something like /var/ossec/bin/ossec-control status | grep -v "not used by ossec, removing", for when the status command kills a process it's not using) Then set an appropriate frequency to run the script. On Monday, June 10, 2013 9:29:26 AM UTC+1, Amritha Kumar wrote: > > Hi, > > I have installed ossec server on a Red Hat linux machine and have 30 > agents installed on both linux and windows machines. The ossec.conf file > has the default settings in it and i have also configured email alerts. i > have noticed in many occasions that the agent goes down and i don't get to > know about it at all. So please tell me how to configure email alerts to be > generated if any one of the installed agent is down or not communicating > with the ossec server for a long period of time like 24 hours. > > Thanks > Amritha > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
