[ossec-list] Re: Matching questions

[Nicolas Arias <nicolas.arias@xxxxxxxxxxx>]

Yes, so, i suppose that you need something like that or to use some king
of "flag" in the script.

When it start it opens a file in /tmp, and when it finishes it removes
that file.

With another script you can check the presence of the flag file and you
can log something.

CHeers!



On Mon, 2007-02-05 at 11:47 -0500, Mark Haney wrote:
> Nicolas Arias wrote:
> > I think that the feature that you are asking for is not supported,
> > buuuuut, you can modify the scritp that you are running with cron to log
> > a line, with logger, when it starts, so, then with ossec you can
> > correlate that entry with the finished one....
> > 
> > 
> > CHeers!
> > Nico
> > 
> I already have a 'START' log event, but I'm trying to test for 2 
> scenarios, one, that the 'START' event isn't logged at all, or two, that 
> I do not get a 'Finished' log event during the course of the day.
> 
> basically I'm trying to alert either if the job doesn't start at all, or 
> if it starts but hangs and doesn't finish.  Does that make sense?
> 
>