contrib-munin/plugins/ossec/ossec-alerts

#!/bin/bash

if [ "$1" = "autoconf" ]; then
echo "yes"
exit 0
fi

if [ "$1" = "config" ]; then
echo "graph_title Ossec Alerts per service"
echo "graph_args --base 1000 -l 0"
echo "graph_vlabel Number of Alerts per service"
echo "graph_category Ossec"
echo "graph_scale no"
echo "apache.label APACHE"
echo "apache.draw LINE2"
echo 'apache.min 0'
echo "ssh.label SSH"
echo "ssh.draw LINE2"
echo 'ssh.min 0'
echo "sudo.label SUDO"
echo "sudo.draw LINE2"
echo 'sudo.min 0'
echo "total.label TOTAL"
echo "total.draw LINE2"
echo 'total.min 0'
exit 0
fi

rm -fr /tmp/ossecalerts*
logdir="/var/ossec/logs/alerts"

###For Loop for grepping the last 5 mins logs 
for (( i = 5; i >=0; i-- )) ; do
     grep $(date +%R -d "-$i  min") $logdir/alerts.log >> /tmp/ossecalerts.log
done

APACHE=`cat /tmp/ossecalerts.log | grep -i 'apache\|http' | wc -l`
SSH=`cat /tmp/ossecalerts.log | grep ssh | wc -l`
SUDO=`cat /tmp/ossecalerts.log | grep sudo | wc -l`
TOTAL=`cat /tmp/ossecalerts.log | grep -v ">"| wc -l`

echo "apache.value ${APACHE}"
echo "ssh.value ${SSH}"
echo "sudo.value ${SUDO}"
echo "total.value ${TOTAL}"
exit 0