Question

在自动缩放不断创建/删除实例的组的情况下自动删除非活动的ossec代理所需的内容

Answer 1

这是一个快速脚本，您可以运行以删除“已断开连接”和“从未连接”代理

for OUTPUT in $(/var/ossec/bin/agent_control -l | grep -E 'Disconnected|Never' | tr ':' ',' | cut -d "," -f 2 )
do
  /var/ossec/bin/manage_agents -r $OUTPUT
done

Answer 2

#This is to be run on ossec server, path for ossec is /var/ossec/

    file=agents.txt
    /var/ossec/bin/agent_control -l > $file

#Wipe working tmp files
    rm remove.txt
    rm removed.txt
    echo -n "" > remove.txt
    echo -n "" > removed.txt

#Find Disconnected agents
    while IFS= read -r line
    do
    ids=$(echo $line | awk '{print $2}')
    status=$(echo $line | awk '{print $NF}')

    if [ "$status" == "Disconnected" ]; then
    echo $ids >> remove.txt
    fi
    done < "$file"

#Find Never connected agents
    while IFS= read -r line
    do
    ids=$(echo $line | awk '{print $2}')
    status=$(echo $line | awk '{ if (NF > 1) print $(NF-1),$NF ; else print $NF; }')

    if [ "$status" == "Never connected" ]; then
       echo $ids >> remove.txt
    fi

    done < "$file"

#Remove commas 
    sed 's/.$//' remove.txt > removed.txt

#Remove agents with IDs in removed.txt file
    file2=removed.txt

    while IFS= read -r line
    do
    /var/ossec/bin/manage_agents -r "$line"
    done < $file2

#Restart OSSEC service
    /var/ossec/bin/ossec-control restart
#End

如何自动删除非活动的OSSEC代理（批处理）

2 个答案: