[ossec-list] Re: Matching questions

["Mark Haney" <mhaney@xxxxxxxxxxxxxxxx>]

Nicolas Arias wrote:
> I think that the feature that you are asking for is not supported,
> buuuuut, you can modify the scritp that you are running with cron to log
> a line, with logger, when it starts, so, then with ossec you can
> correlate that entry with the finished one....
>
>
> CHeers!
> Nico
I already have a 'START' log event, but I'm trying to test for 2 
scenarios, one, that the 'START' event isn't logged at all, or two, that 
I do not get a 'Finished' log event during the course of the day.

basically I'm trying to alert either if the job doesn't start at all, or 
if it starts but hangs and doesn't finish.  Does that make sense?


--
Ita erat quando hic adveni.

Mark Haney
Sr. Systems Administrator
ERC Broadband
(828) 350-2415