On Tue, Nov 26, 2013 at 8:52 AM, C. L. Martinez <[email protected]> wrote: > On Tue, Nov 26, 2013 at 1:09 PM, dan (ddp) <[email protected]> wrote: >> On Tue, Nov 26, 2013 at 3:08 AM, C. L. Martinez <[email protected]> wrote: >>> On Tue, Nov 26, 2013 at 6:12 AM, C. L. Martinez <[email protected]> >>> wrote: >>>> On Mon, Nov 25, 2013 at 2:06 PM, C. L. Martinez <[email protected]> >>>> wrote: >>>>> On Mon, Nov 25, 2013 at 2:02 PM, dan (ddp) <[email protected]> wrote: >>>>>> On Mon, Nov 25, 2013 at 8:51 AM, C. L. Martinez <[email protected]> >>>>>> wrote: >>>>>>> On Mon, Nov 25, 2013 at 1:17 PM, dan (ddp) <[email protected]> wrote: >>>>>>>> On Mon, Nov 25, 2013 at 6:36 AM, C. L. Martinez <[email protected]> >>>>>>>> wrote: >>>>>>>>> Hi all, >>>>>>>>> >>>>>>>>> Last week, I have updated 5 clients and one ossec server to release >>>>>>>>> 2.7.1. My surprise is with restart-ossec active response: it doesn't >>>>>>>>> works. >>>>>>>>> >>>>>>>>> My config (as appears in OSSEC docs) is: >>>>>>>>> >>>>>>>>> <command> >>>>>>>>> <name>restart-ossec</name> >>>>>>>>> <executable>restart-ossec.sh</executable> >>>>>>>>> <expect></expect> >>>>>>>>> </command> >>>>>>>>> >>>>>>>>> <active-response> >>>>>>>>> <command>restart-ossec</command> >>>>>>>>> <location>local</location> >>>>>>>>> <rules_id>120000</rules_id> >>>>>>>>> </active-response> >>>>>>>>> >>>>>>>>> and rule 120000: >>>>>>>>> >>>>>>>>> <rule id="120000" level="10"> >>>>>>>>> <if_sid>550</if_sid> >>>>>>>>> <match>/var/ossec/etc/shared/agent.conf</match> >>>>>>>>> <description>Customized agent.conf has been >>>>>>>>> modified.</description> >>>>>>>>> </rule> >>>>>>>>> >>>>>>>>> but running agent_control -L: >>>>>>>>> >>>>>>>>> OSSEC HIDS agent_control. Available active responses: >>>>>>>>> >>>>>>>>> Response name: firewall-drop86400, command: firewall-drop.sh >>>>>>>>> >>>>>>>>> .. it doesn't appears ... Any idea why?? >>>>>>>>> >>>>>>>> >>>>>>>> Is ossec-execd running? >>>>>>>> >>>>>>>>> -- >>>>>>> >>>>>>> Yes, in all components: agents and server ... >>>>>>> >>>>>> >>>>>> Is 120000 firing properly? >>>>>> >>>>>>> -- >>>>>>> >>>>> >>>>> Yes, according to my tests .... To be sure, I have added >>>>> /var/ossec/etc/shared to syscheck section. For example: >>>>> >>>>> <agent_config os="Linux"> >>>>> <syscheck> >>>>> <scan_on_start>no</scan_on_start> >>>>> <frequency>43200</frequency> >>>>> <scan_time>01:33</scan_time> >>>>> <auto_ignore>no</auto_ignore> >>>>> <alert_new_files>yes</alert_new_files> >>>>> <directories report_changes="yes" realtime="yes" >>>>> check_all="yes">/etc,/var/ossec/etc/shared</directories> >>>>> <directories check_all="yes" >>>>> realtime="yes">/usr/bin,/usr/sbin,/bin,/sbin,/usr/local/bin,/usr/local/sbin</directories> >>>>> <ignore>/etc/adjtime</ignore> >>>>> <ignore>/etc/aliases.db</ignore> >>>>> <ignore>/etc/hosts.deny</ignore> >>>>> <ignore>/etc/ld.so.cache</ignore> >>>>> <ignore>/etc/lvm/cache/.cache</ignore> >>>>> <ignore>/etc/mtab</ignore> >>>>> >>>>> <ignore>/etc/rc.d/rc0.d,/etc/rc.d/rc1.d,/etc/rc.d/rc2.d,/etc/rc.d/rc3.d,/etc/rc.d/rc4.d,/etc/rc.d/rc5.d,/etc/rc.d/rc6.d</ignore> >>>>> </syscheck> >>>>> .... >>>> >>>> >>>> Please, any idea ?? >>> >>> >>> Uhmm .. is this restart-ossec.sh script correct?? >>> >> >> The best part about open source is that you don't have to ask such questions: >> https://bitbucket.org/jbcheng/ossec-hids/src/e0b12fd4961c97850841a6f1a7e8af47f1bb3e41/active-response/restart-ossec.sh?at=default >> > > I've checked first, and it is the same script.... >
Then I misunderstood. What part of the script looks incorrect to you? > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/groups/opt_out. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
