mirror of
https://github.com/munin-monitoring/contrib.git
synced 2025-07-21 18:41:03 +00:00
update the ossec plugin
- harmonize the coding style of the three scripts - harmonize the label names and file names with other popular plugins - fix active_response script to use correct date format
This commit is contained in:
Christian Beer
parent
375621b4ba
commit
c098ee86fa
6 changed files with 126 additions and 156 deletions
|
|
@ -1,79 +0,0 @@
|
||||||
|
|
||||||
# /bin/ sh
|
|
||||||
#
|
|
||||||
if [ "$1" = "autoconf" ] ; then
|
|
||||||
|
|
||||||
echo "yes"
|
|
||||||
#
|
|
||||||
exit 0
|
|
||||||
#
|
|
||||||
fi
|
|
||||||
#
|
|
||||||
#
|
|
||||||
logdir="/var/ossec/logs/"
|
|
||||||
if [ "$1" = "config" ] ; then
|
|
||||||
#
|
|
||||||
echo "graph_title Active Response"
|
|
||||||
#
|
|
||||||
echo "graph_args --base 1000 -l 0 "
|
|
||||||
#
|
|
||||||
echo "graph_vlabel Number of active response"
|
|
||||||
#
|
|
||||||
echo "graph_category Ossec"
|
|
||||||
#
|
|
||||||
echo "graph_scale no"
|
|
||||||
#
|
|
||||||
echo "c_add_actions.label Number of Rules added"
|
|
||||||
#
|
|
||||||
echo "c_add_actions.draw LINE2"
|
|
||||||
#
|
|
||||||
echo 'c_add_actions.min 0'
|
|
||||||
#
|
|
||||||
echo "c_del_actions.label Number of Rules deleted"
|
|
||||||
#
|
|
||||||
echo "c_del_actions.draw LINE2"
|
|
||||||
#
|
|
||||||
echo 'c_del_actions.min 0'
|
|
||||||
#
|
|
||||||
exit 0
|
|
||||||
#
|
|
||||||
fi
|
|
||||||
#
|
|
||||||
#
|
|
||||||
|
|
||||||
|
|
||||||
####Deleting the temporary logs files ##########
|
|
||||||
rm -fr /tmp/ossecactive*
|
|
||||||
|
|
||||||
|
|
||||||
###For Loop for grepping the last 5 mins logs and moving it to the /tmp
|
|
||||||
|
|
||||||
month="$(date "+%b")"; time="$(date "+%d")";year="$(date "+%Y")";
|
|
||||||
if [ "$time" -le "9" ]; then
|
|
||||||
search1="$month $time"
|
|
||||||
else
|
|
||||||
search1="$month $time"
|
|
||||||
fi
|
|
||||||
|
|
||||||
#search1="$month $time"
|
|
||||||
#echo "$search1"
|
|
||||||
for (( i = 5; i>=0; i-- )) ; do grep $(date "+%R" -d "-$i min") /var/ossec/logs/active-responses.log | grep "$search1" | grep "$year" >> /tmp/ossecactive.log;done
|
|
||||||
|
|
||||||
|
|
||||||
#############Fore Loop Ends##########
|
|
||||||
|
|
||||||
####Grepping the Hosts Blocked in last 5 mins###########
|
|
||||||
NB_ADD=`cat /tmp/ossecactive.log| grep add | wc -l`
|
|
||||||
|
|
||||||
###########Grepping the Hosts Removed from the blocked list in last 5 mins############
|
|
||||||
|
|
||||||
NB_DEL=`cat /tmp/ossecactive.log | grep del | wc -l`
|
|
||||||
#
|
|
||||||
#
|
|
||||||
|
|
||||||
############Displaying the VALUES#############
|
|
||||||
echo "c_add_actions.value ${NB_ADD}"
|
|
||||||
#
|
|
||||||
echo "c_del_actions.value ${NB_DEL}" #
|
|
||||||
#
|
|
||||||
exit 0
|
|
||||||
|
|
@ -1,31 +0,0 @@
|
||||||
#!/bin/bash
|
|
||||||
|
|
||||||
if [ "$1" = "autoconf" ]; then
|
|
||||||
echo "yes"
|
|
||||||
exit 0
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [ "$1" = "config" ]; then
|
|
||||||
echo "graph_title Ossec Agents Status"
|
|
||||||
echo "graph_args --base 1000 -l 0"
|
|
||||||
echo "graph_vlabel Number of Ossec Agents"
|
|
||||||
echo "graph_category Ossec"
|
|
||||||
echo "graph_scale no"
|
|
||||||
echo "active.label ACTIVE"
|
|
||||||
echo "active.draw LINE2"
|
|
||||||
echo 'active.min 0'
|
|
||||||
echo "inactive.label INACTIVE"
|
|
||||||
echo "inactive.draw LINE2"
|
|
||||||
echo 'inactive.min 0'
|
|
||||||
exit 0
|
|
||||||
fi
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
ACTIVE=`/var/ossec/bin/list_agents -c | grep -wv "** No agent available" | wc -l`
|
|
||||||
INACTIVE=`/var/ossec/bin/list_agents -n | grep -wv "** No agent available" | wc -l`
|
|
||||||
|
|
||||||
echo "active.value ${ACTIVE}"
|
|
||||||
echo "inactive.value ${INACTIVE}"
|
|
||||||
exit 0
|
|
||||||
|
|
@ -1,46 +0,0 @@
|
||||||
#!/bin/bash
|
|
||||||
|
|
||||||
if [ "$1" = "autoconf" ]; then
|
|
||||||
echo "yes"
|
|
||||||
exit 0
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [ "$1" = "config" ]; then
|
|
||||||
echo "graph_title Ossec Alerts per service"
|
|
||||||
echo "graph_args --base 1000 -l 0"
|
|
||||||
echo "graph_vlabel Number of Alerts per service"
|
|
||||||
echo "graph_category Ossec"
|
|
||||||
echo "graph_scale no"
|
|
||||||
echo "apache.label APACHE"
|
|
||||||
echo "apache.draw LINE2"
|
|
||||||
echo 'apache.min 0'
|
|
||||||
echo "ssh.label SSH"
|
|
||||||
echo "ssh.draw LINE2"
|
|
||||||
echo 'ssh.min 0'
|
|
||||||
echo "sudo.label SUDO"
|
|
||||||
echo "sudo.draw LINE2"
|
|
||||||
echo 'sudo.min 0'
|
|
||||||
echo "total.label TOTAL"
|
|
||||||
echo "total.draw LINE2"
|
|
||||||
echo 'total.min 0'
|
|
||||||
exit 0
|
|
||||||
fi
|
|
||||||
|
|
||||||
rm -fr /tmp/ossecalerts*
|
|
||||||
logdir="/var/ossec/logs/alerts"
|
|
||||||
|
|
||||||
###For Loop for grepping the last 5 mins logs
|
|
||||||
for (( i = 5; i >=0; i-- )) ; do
|
|
||||||
grep $(date +%R -d "-$i min") $logdir/alerts.log >> /tmp/ossecalerts.log
|
|
||||||
done
|
|
||||||
|
|
||||||
APACHE=`cat /tmp/ossecalerts.log | grep -i 'apache\|http' | wc -l`
|
|
||||||
SSH=`cat /tmp/ossecalerts.log | grep ssh | wc -l`
|
|
||||||
SUDO=`cat /tmp/ossecalerts.log | grep sudo | wc -l`
|
|
||||||
TOTAL=`cat /tmp/ossecalerts.log | grep -v ">"| wc -l`
|
|
||||||
|
|
||||||
echo "apache.value ${APACHE}"
|
|
||||||
echo "ssh.value ${SSH}"
|
|
||||||
echo "sudo.value ${SUDO}"
|
|
||||||
echo "total.value ${TOTAL}"
|
|
||||||
exit 0
|
|
||||||
45
plugins/ossec/ossec_active_response
Executable file
45
plugins/ossec/ossec_active_response
Executable file
|
|
@ -0,0 +1,45 @@
|
||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
if [ "$1" = "autoconf" ]; then
|
||||||
|
echo "yes"
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ "$1" = "config" ]; then
|
||||||
|
echo "graph_title OSSEC Active Response"
|
||||||
|
echo "graph_args --base 1000 -l 0"
|
||||||
|
echo "graph_vlabel Number of responses"
|
||||||
|
echo "graph_category ossec"
|
||||||
|
echo "graph_scale no"
|
||||||
|
echo "c_add_actions.label rules added"
|
||||||
|
echo "c_add_actions.draw LINE2"
|
||||||
|
echo 'c_add_actions.min 0'
|
||||||
|
echo "c_del_actions.label rules deleted"
|
||||||
|
echo "c_del_actions.draw LINE2"
|
||||||
|
echo 'c_del_actions.min 0'
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
### Deleting temporary log files from last run
|
||||||
|
rm -f /tmp/ossecactive.log
|
||||||
|
logdir="/var/ossec/logs"
|
||||||
|
|
||||||
|
|
||||||
|
### day of moth needs to be space padded
|
||||||
|
month="$(date "+%b")"; day="$(date "+%e")";year="$(date "+%Y")";
|
||||||
|
search1="$month $day"
|
||||||
|
|
||||||
|
### for loop for grepping the last 5 min of logs and copy it to /tmp
|
||||||
|
for (( i = 5; i >=0; i-- )) ; do
|
||||||
|
grep $(date "+%R" -d "-$i min") $logdir/active-responses.log | grep "$search1" | grep "$year" >> /tmp/ossecactive.log
|
||||||
|
done
|
||||||
|
### End for loop
|
||||||
|
|
||||||
|
### count the lines for each action in the temporary log file
|
||||||
|
NB_ADD=`cat /tmp/ossecactive.log | grep add | wc -l`
|
||||||
|
NB_DEL=`cat /tmp/ossecactive.log | grep del | wc -l`
|
||||||
|
|
||||||
|
echo "c_add_actions.value ${NB_ADD}"
|
||||||
|
echo "c_del_actions.value ${NB_DEL}"
|
||||||
|
|
||||||
|
exit 0
|
||||||
32
plugins/ossec/ossec_agents
Executable file
32
plugins/ossec/ossec_agents
Executable file
|
|
@ -0,0 +1,32 @@
|
||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
if [ "$1" = "autoconf" ]; then
|
||||||
|
echo "yes"
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ "$1" = "config" ]; then
|
||||||
|
echo "graph_title Ossec agents status"
|
||||||
|
echo "graph_args --base 1000 -l 0"
|
||||||
|
echo "graph_vlabel Number of ossec agents"
|
||||||
|
echo "graph_category ossec"
|
||||||
|
echo "graph_scale no"
|
||||||
|
echo "active.label active"
|
||||||
|
echo "active.draw LINE2"
|
||||||
|
echo 'active.min 0'
|
||||||
|
echo "inactive.label inactive"
|
||||||
|
echo "inactive.draw LINE2"
|
||||||
|
echo 'inactive.min 0'
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
### where to find the ossec tools
|
||||||
|
ossecdir="/var/ossec/bin"
|
||||||
|
|
||||||
|
### count the lines from the output of the list_agents tool
|
||||||
|
ACTIVE=`$ossecdir/list_agents -c | grep -wv "** No agent available" | wc -l`
|
||||||
|
INACTIVE=`$ossecdir/list_agents -n | grep -wv "** No agent available" | wc -l`
|
||||||
|
|
||||||
|
echo "active.value ${ACTIVE}"
|
||||||
|
echo "inactive.value ${INACTIVE}"
|
||||||
|
exit 0
|
||||||
49
plugins/ossec/ossec_alerts
Executable file
49
plugins/ossec/ossec_alerts
Executable file
|
|
@ -0,0 +1,49 @@
|
||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
if [ "$1" = "autoconf" ]; then
|
||||||
|
echo "yes"
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ "$1" = "config" ]; then
|
||||||
|
echo "graph_title Ossec alerts per service"
|
||||||
|
echo "graph_args --base 1000 -l 0"
|
||||||
|
echo "graph_vlabel Number of alerts per service"
|
||||||
|
echo "graph_category ossec"
|
||||||
|
echo "graph_scale no"
|
||||||
|
echo "apache.label httpd"
|
||||||
|
echo "apache.draw LINE2"
|
||||||
|
echo 'apache.min 0'
|
||||||
|
echo "ssh.label ssh"
|
||||||
|
echo "ssh.draw LINE2"
|
||||||
|
echo 'ssh.min 0'
|
||||||
|
echo "sudo.label sudo"
|
||||||
|
echo "sudo.draw LINE2"
|
||||||
|
echo 'sudo.min 0'
|
||||||
|
echo "total.label total"
|
||||||
|
echo "total.draw LINE2"
|
||||||
|
echo 'total.min 0'
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
### Deleting temporary log files from last run
|
||||||
|
rm -f /tmp/ossecalerts.log
|
||||||
|
logdir="/var/ossec/logs/alerts"
|
||||||
|
|
||||||
|
###For Loop for grepping the last 5 mins logs
|
||||||
|
for (( i = 5; i >=0; i-- )) ; do
|
||||||
|
grep $(date +%R -d "-$i min") $logdir/alerts.log >> /tmp/ossecalerts.log
|
||||||
|
done
|
||||||
|
### End for loop
|
||||||
|
|
||||||
|
### count the lines for each service in the temporary log file
|
||||||
|
APACHE=`cat /tmp/ossecalerts.log | grep -i 'apache\|http' | wc -l`
|
||||||
|
SSH=`cat /tmp/ossecalerts.log | grep ssh | wc -l`
|
||||||
|
SUDO=`cat /tmp/ossecalerts.log | grep sudo | wc -l`
|
||||||
|
TOTAL=`cat /tmp/ossecalerts.log | grep -v ">"| wc -l`
|
||||||
|
|
||||||
|
echo "apache.value ${APACHE}"
|
||||||
|
echo "ssh.value ${SSH}"
|
||||||
|
echo "sudo.value ${SUDO}"
|
||||||
|
echo "total.value ${TOTAL}"
|
||||||
|
exit 0
|
||||||
Loading…
Add table
Add a link
Reference in a new issue