72 |
<LI><A HREF="#postfix">Postfix (mail server)</A></LI> |
<LI><A HREF="#postfix">Postfix (mail server)</A></LI> |
73 |
<LI><A HREF="#sendmail">sendmail (mail server)</A></LI> |
<LI><A HREF="#sendmail">sendmail (mail server)</A></LI> |
74 |
<LI><A HREF="#qpopper">Qpopper (pop3 server)</A></LI> |
<LI><A HREF="#qpopper">Qpopper (pop3 server)</A></LI> |
75 |
|
<LI><A HREF="#spamd">Spamassassin daemon (spam scan daemon)</A></LI> |
76 |
|
<LI><A HREF="#amavis">Amavis-new (mail virus scanner)</A></LI> |
77 |
|
</ul> |
78 |
|
</li> |
79 |
|
<li> Virus Scanner |
80 |
|
<ul> |
81 |
<LI><A HREF="#sophie">Sophie (virus scan daemon)</A></LI> |
<LI><A HREF="#sophie">Sophie (virus scan daemon)</A></LI> |
82 |
<LI><A HREF="#trophie">Trophie (virus scan daemon)</A></LI> |
<LI><A HREF="#trophie">Trophie (virus scan daemon)</A></LI> |
83 |
<LI><A HREF="#spamd">Spamassassin daemon (spam scan daemon)</A></LI> |
<LI><A HREF="#clamavd">Clamavd (virus scan daemon)</A></LI> |
84 |
</ul> |
</ul> |
85 |
</li> |
</li> |
86 |
<li> Printing Services |
<li> Printing Services |
109 |
<li> Misc Services |
<li> Misc Services |
110 |
<ul> |
<ul> |
111 |
<LI><A HREF="#apcupsd">apcupsd (APC ups daemon)</A></LI> |
<LI><A HREF="#apcupsd">apcupsd (APC ups daemon)</A></LI> |
|
</ul> |
|
|
<ul> |
|
112 |
<LI><A HREF="#webmin">Webmin (remote admin service)</A></LI> |
<LI><A HREF="#webmin">Webmin (remote admin service)</A></LI> |
113 |
|
<LI><A HREF="#stunnel">STunnel (SSL tunnel)</A></LI> |
114 |
</ul> |
</ul> |
115 |
</li> |
</li> |
116 |
</ul> |
</ul> |
437 |
alert foo@bar |
alert foo@bar |
438 |
</pre> |
</pre> |
439 |
|
|
440 |
|
<h3><a name="spamd">Spamassassin daemon (spam scan daemon)</a></h3> |
441 |
|
<pre> |
442 |
|
check process spamd with pidfile /var/run/spamd.pid |
443 |
|
group mail |
444 |
|
start program = "/etc/init.d/spamd start" |
445 |
|
stop program = "/etc/init.d/spamd stop" |
446 |
|
if 5 restarts within 5 cycles then timeout |
447 |
|
alert foo@bar |
448 |
|
alert 123456@sms on { timeout } |
449 |
|
depends on spamd_bin |
450 |
|
depends on spamd_rc |
451 |
|
|
452 |
|
check file smapd_bin with path /usr/local/bin/spamd |
453 |
|
group mail |
454 |
|
if failed checksum then unmonitor |
455 |
|
if failed permission 755 then unmonitor |
456 |
|
if failed uid root then unmonitor |
457 |
|
if failed gid root then unmonitor |
458 |
|
alert foo@bar |
459 |
|
|
460 |
|
check file spamd_rc with path /etc/init.d/spamd |
461 |
|
group mail |
462 |
|
if failed checksum then unmonitor |
463 |
|
if failed permission 755 then unmonitor |
464 |
|
if failed uid root then unmonitor |
465 |
|
if failed gid root then unmonitor |
466 |
|
alert foo@bar |
467 |
|
</pre> |
468 |
|
|
469 |
|
<h3><a name="amavis">Amavis-new (mail virus scanner)</a></h3> |
470 |
|
<pre> |
471 |
|
check process amavisd with pidfile /opt/virus/amavis-new/var/run/amavisd.pid |
472 |
|
group mail |
473 |
|
start program = "/etc/init.d/amavis-new start" |
474 |
|
stop program = "/etc/init.d/amavis-new stop" |
475 |
|
if failed port 10024 protocol smtp then restart |
476 |
|
if 5 restarts within 5 cycles then timeout |
477 |
|
alert foo@bar |
478 |
|
alert 123456@sms on { timeout } |
479 |
|
depends on amavisd_bin |
480 |
|
depends on amavisd_rc |
481 |
|
|
482 |
|
check file amavisd_bin with path /opt/virus/amavis-new/bin/amavisd |
483 |
|
group mail |
484 |
|
if failed checksum then unmonitor |
485 |
|
if failed permission 755 then unmonitor |
486 |
|
if failed uid root then unmonitor |
487 |
|
if failed gid root then unmonitor |
488 |
|
alert foo@bar |
489 |
|
|
490 |
|
check file amavisd_rc with path /etc/init.d/amavis-new |
491 |
|
group mail |
492 |
|
if failed checksum then unmonitor |
493 |
|
if failed permission 755 then unmonitor |
494 |
|
if failed uid root then unmonitor |
495 |
|
if failed gid root then unmonitor |
496 |
|
alert foo@bar |
497 |
|
</pre> |
498 |
|
|
499 |
|
<h2>Virus Scanner</h2> |
500 |
<h3><a name="sophie">Sophie (virus scan daemon)</a></h3> |
<h3><a name="sophie">Sophie (virus scan daemon)</a></h3> |
501 |
<pre> |
<pre> |
502 |
check process sophie with pidfile /var/run/sophie.pid |
check process sophie with pidfile /var/run/sophie.pid |
503 |
group mail |
group virus |
504 |
start program = "/etc/init.d/sophie start" |
start program = "/etc/init.d/sophie start" |
505 |
stop program = "/etc/init.d/sophie stop" |
stop program = "/etc/init.d/sophie stop" |
506 |
if failed unixsocket /var/run/sophie then restart |
if failed unixsocket /var/run/sophie then restart |
511 |
depends on sophie_rc |
depends on sophie_rc |
512 |
|
|
513 |
check file sophie_bin with path /opt/virus/sophie/sophie |
check file sophie_bin with path /opt/virus/sophie/sophie |
514 |
group mail |
group virus |
515 |
if failed checksum then unmonitor |
if failed checksum then unmonitor |
516 |
if failed permission 755 then unmonitor |
if failed permission 755 then unmonitor |
517 |
if failed uid root then unmonitor |
if failed uid root then unmonitor |
519 |
alert foo@bar |
alert foo@bar |
520 |
|
|
521 |
check file sophie_rc with path /etc/init.d/sophie |
check file sophie_rc with path /etc/init.d/sophie |
522 |
group mail |
group virus |
523 |
if failed checksum then unmonitor |
if failed checksum then unmonitor |
524 |
if failed permission 755 then unmonitor |
if failed permission 755 then unmonitor |
525 |
if failed uid root then unmonitor |
if failed uid root then unmonitor |
531 |
<h3><a name="trophie">Trophie (virus scan daemon)</a></h3> |
<h3><a name="trophie">Trophie (virus scan daemon)</a></h3> |
532 |
<pre> |
<pre> |
533 |
check process trophie with pidfile /var/run/trophie.pid |
check process trophie with pidfile /var/run/trophie.pid |
534 |
group mail |
group virus |
535 |
start program = "/etc/init.d/trophie start" |
start program = "/etc/init.d/trophie start" |
536 |
stop program = "/etc/init.d/trophie stop" |
stop program = "/etc/init.d/trophie stop" |
537 |
if failed unixsocket /var/run/trophie then restart |
if failed unixsocket /var/run/trophie then restart |
542 |
depends on trophie_rc |
depends on trophie_rc |
543 |
|
|
544 |
check file trophie_bin with path /opt/virus/trophie/trophie |
check file trophie_bin with path /opt/virus/trophie/trophie |
545 |
group mail |
group virus |
546 |
if failed checksum then unmonitor |
if failed checksum then unmonitor |
547 |
if failed permission 755 then unmonitor |
if failed permission 755 then unmonitor |
548 |
if failed uid root then unmonitor |
if failed uid root then unmonitor |
550 |
alert foo@bar |
alert foo@bar |
551 |
|
|
552 |
check file trophie_rc with path /etc/init.d/trophie |
check file trophie_rc with path /etc/init.d/trophie |
553 |
group mail |
group virus |
554 |
if failed checksum then unmonitor |
if failed checksum then unmonitor |
555 |
if failed permission 755 then unmonitor |
if failed permission 755 then unmonitor |
556 |
if failed uid root then unmonitor |
if failed uid root then unmonitor |
558 |
alert foo@bar |
alert foo@bar |
559 |
</pre> |
</pre> |
560 |
|
|
561 |
<h3><a name="spamd">Spamassassin daemon (spam scan daemon)</a></h3> |
<h3><a name="clamavd">Clamav (virus scan daemon)</a></h3> |
562 |
<pre> |
<pre> |
563 |
check process spamd with pidfile /var/run/spamd.pid |
check process clamavd with pidfile /var/run/clamd.pid |
564 |
group mail |
group virus |
565 |
start program = "/etc/init.d/spamd start" |
start program = "/etc/init.d/clamavd start" |
566 |
stop program = "/etc/init.d/spamd stop" |
stop program = "/etc/init.d/clamavd stop" |
567 |
|
if failed unixsocket /var/run/clamd then restart |
568 |
if 5 restarts within 5 cycles then timeout |
if 5 restarts within 5 cycles then timeout |
569 |
alert foo@bar |
alert foo@bar |
570 |
alert 123456@sms on { timeout } |
alert 123456@sms on { timeout } |
571 |
depends on spamd_bin |
depends on clamavd_bin |
572 |
depends on spamd_rc |
depends on clamavd_rc |
573 |
|
|
574 |
check file smapd_bin with path /usr/local/bin/spamd |
check file clamavd_bin with path /opt/virus/clamavd/clamavd |
575 |
group mail |
group virus |
576 |
if failed checksum then unmonitor |
if failed checksum then unmonitor |
577 |
if failed permission 755 then unmonitor |
if failed permission 755 then unmonitor |
578 |
if failed uid root then unmonitor |
if failed uid root then unmonitor |
579 |
if failed gid root then unmonitor |
if failed gid root then unmonitor |
580 |
alert foo@bar |
alert foo@bar |
581 |
|
|
582 |
check file spamd_rc with path /etc/init.d/spamd |
check file clamavd_rc with path /etc/init.d/clamavd |
583 |
group mail |
group virus |
584 |
if failed checksum then unmonitor |
if failed checksum then unmonitor |
585 |
if failed permission 755 then unmonitor |
if failed permission 755 then unmonitor |
586 |
if failed uid root then unmonitor |
if failed uid root then unmonitor |
962 |
if failed checksum then unmonitor |
if failed checksum then unmonitor |
963 |
if failed permission 755 then unmonitor |
if failed permission 755 then unmonitor |
964 |
if failed uid root then unmonitor |
if failed uid root then unmonitor |
965 |
|
if failed gid root then unmonitor |
966 |
|
alert foo@bar |
967 |
|
</pre> |
968 |
|
|
969 |
|
<h3><a name="stunnel">STunnel (SSL tunnel)</a></h3> |
970 |
|
<pre> |
971 |
|
check process stunnel_pop3 with pidfile /opt/var/stunnel/stunnel.110.pid |
972 |
|
start program = "/etc/init.d/stunnel start_pop3" |
973 |
|
stop program = "/etc/init.d/stunnel stop_pop3" |
974 |
|
if failed host 192.168.1.1 port 143 type TCPSSL protocol POP then restart |
975 |
|
group stunnel |
976 |
|
alert foo@bar |
977 |
|
depends stunnel_init |
978 |
|
depends stunnel_bin |
979 |
|
|
980 |
|
check process stunnel_swat with pidfile /opt/var/stunnel/stunnel.901.pid |
981 |
|
start program = "/etc/init.d/stunnel start_swat" |
982 |
|
stop program = "/etc/init.d/stunnel stop_swat" |
983 |
|
if failed host 192.168.1.1 port 995 type TCPSSL then restart |
984 |
|
group stunnel |
985 |
|
alert foo@bar |
986 |
|
alert 123456@sms on { timeout } |
987 |
|
depends stunnel_bin |
988 |
|
depends stunnel_rc |
989 |
|
|
990 |
|
check file stunnel_bin with path /opt/sbin/stunnel |
991 |
|
group stunnel |
992 |
|
if failed checksum then unmonitor |
993 |
|
if failed permission 755 then unmonitor |
994 |
|
if failed uid root then unmonitor |
995 |
|
if failed gid root then unmonitor |
996 |
|
alert foo@bar |
997 |
|
|
998 |
|
check file stunnel_rc with path /etc/init.d/stunnel |
999 |
|
group stunnel |
1000 |
|
if failed checksum then unmonitor |
1001 |
|
if failed permission 755 then unmonitor |
1002 |
|
if failed uid root then unmonitor |
1003 |
if failed gid root then unmonitor |
if failed gid root then unmonitor |
1004 |
alert foo@bar |
alert foo@bar |
1005 |
</pre> |
</pre> |