|
Sensors
Audit Categories
Sensors are grouped into audit categories.
| app |
This is a user application audit. |
| boot |
When OSsonar starts, if the system has rebooted since OSsonar was shutdown, then these audits are run. The schedules on these sensors are ignored. |
| disk |
This is a disk or filesystem audit. |
| file |
This is a file audit. |
| hw |
This is a hardware audit. |
| me |
Reserved for OSsonar's internal audits. |
| net |
This is a network audit. |
| perf |
This is a performance audit. |
| proc |
This is a process audit. |
| sec |
This is a security audit. |
sys
|
This is a system audit. |
usr
|
This is a user audit. |
Sensor Lists By OS Platform
Scheduling Sensors
- The normal way to run a sensor is to configure it to be selected by the Schedule Manager. This configuration is similar to scheduling cron jobs.
- Another way is to schedule the sensor from a program. The programs calls:
/ossonar/bin/runsensornow NAME_OF_SENSOR
The sensor could be "off" (disabled) in the config file and only scheduled by your program. The utility program "runsensornow" will cause the Schedule Manager to schedule the sensor now. It is not a good idea to run the sensor directly as you would have to handle all things including the alert yourself.
Cloning Sensors
You may want to clone a sensor. By this I mean to hard link a sensor in /ossonar/sensors/$PLATFORM to create another one. For example you might
ln perf_ckmysql.sh perf_ckmysql2.sh
This would create a new sensor called perf_ckmysql2.sh. You use hard link rather than copy so that when perf_ckmysql.sh is updated so will be perf_ckmysql2.sh.
You might do this because you want to put one in one sensor group and another in a priority sensor group. By scheduling one during the day and the other at night, the alerts can be handled differently. To OSsonar, they are two different sensors.
When cloning, give it some thought. If the sensors are to be completely different, there is no problem. But if the sensors are really one sensor boken up for what ever reason, then you will want to also hard link the sensor's files in /ossonar/etc/tables.
Print this | Send this | Page Views: 1052 |
|
|
Home Page 
RSS News