update the ossec plugin

- harmonize the coding style of the three scripts
- harmonize the label names and file names with other popular plugins
- fix active_response script to use correct date format

plugins/ossec/ossec_alerts

@@ -0,0 +1,49 @@
+#!/bin/bash
+
+if [ "$1" = "autoconf" ]; then
+	echo "yes"
+	exit 0
+fi
+
+if [ "$1" = "config" ]; then
+	echo "graph_title Ossec alerts per service"
+	echo "graph_args --base 1000 -l 0"
+	echo "graph_vlabel Number of alerts per service"
+	echo "graph_category ossec"
+	echo "graph_scale no"
+	echo "apache.label httpd"
+	echo "apache.draw LINE2"
+	echo 'apache.min 0'
+	echo "ssh.label ssh"
+	echo "ssh.draw LINE2"
+	echo 'ssh.min 0'
+	echo "sudo.label sudo"
+	echo "sudo.draw LINE2"
+	echo 'sudo.min 0'
+	echo "total.label total"
+	echo "total.draw LINE2"
+	echo 'total.min 0'
+	exit 0
+fi
+
+### Deleting temporary log files from last run
+rm -f /tmp/ossecalerts.log
+logdir="/var/ossec/logs/alerts"
+
+###For Loop for grepping the last 5 mins logs
+for (( i = 5; i >=0; i-- )) ; do
+	grep $(date +%R -d "-$i  min") $logdir/alerts.log >> /tmp/ossecalerts.log
+done
+### End for loop
+
+### count the lines for each service in the temporary log file
+APACHE=`cat /tmp/ossecalerts.log | grep -i 'apache\|http' | wc -l`
+SSH=`cat /tmp/ossecalerts.log | grep ssh | wc -l`
+SUDO=`cat /tmp/ossecalerts.log | grep sudo | wc -l`
+TOTAL=`cat /tmp/ossecalerts.log | grep -v ">"| wc -l`
+
+echo "apache.value ${APACHE}"
+echo "ssh.value ${SSH}"
+echo "sudo.value ${SUDO}"
+echo "total.value ${TOTAL}"
+exit 0