Process monitoring with OSSEC

OSSEC v2.3 was just released and one feature that really interested me was the Process monitoring. That's what the OSSEC team says about it:

"We love logs. Inside OSSEC we treat everything as if it was a log and parse it appropriately with our rules. However, some information is not available in log files but we still want to monitor them. To solve that gap, we added the ability to monitor the output of commands via OSSEC and treat those just like they were log files."

Basically, it allows you to monitor the output of any command and generate alerts/active responses from them.

Cool, let's try it out. First, let's monitor the output of "httpd status" to receive alerts if Apache ever goes down. I added the following command to my ossec.conf and the following rule to my local_rules:

<localfile>
<log_format>command</log_format>
<command>/etc/init.d/httpd status</command>
</localfile>

<rule id=”100200″ level=”10″ ignore=”1200″>
<if_sid>530</if_sid>
<match>ossec: output: '/etc/init.d/httpd status': </match>
<regex>is stopped</regex>
<description>Apache STOPPED.</description>
</rule>

Now, if I manually stop Apache to try it out, I get in a few seconds via email:

2009 Dec 08 10:45:04 (sucuri) xx->/etc/init.d/httpd status
Rule: 100200 (level 10) -> 'Apache STOPPED.'
Src IP: (none)
User: (none)
ossec: output: '/etc/init.d/httpd status': httpd is stopped

Perfect! Now I can have all my monitoring in just one tool... Next step is to create an active response to restart the service on