如何自动删除非活动OSSEC剂（批）

Question

需要哪些在自动缩放其中为实例创建的组的情况下，自动删除不活动OSSEC代理/删除不断

Answer 1

这里是一个快速脚本，你可以运行删除“断开”和“从未连接的代理人

for OUTPUT in $(/var/ossec/bin/agent_control -l | grep -E 'Disconnected|Never' | tr ':' ',' | cut -d "," -f 2 )
do
  /var/ossec/bin/manage_agents -r $OUTPUT
done

Answer 2

#This is to be run on ossec server, path for ossec is /var/ossec/

    file=agents.txt
    /var/ossec/bin/agent_control -l > $file

#Wipe working tmp files
    rm remove.txt
    rm removed.txt
    echo -n "" > remove.txt
    echo -n "" > removed.txt

#Find Disconnected agents
    while IFS= read -r line
    do
    ids=$(echo $line | awk '{print $2}')
    status=$(echo $line | awk '{print $NF}')

    if [ "$status" == "Disconnected" ]; then
    echo $ids >> remove.txt
    fi
    done < "$file"

#Find Never connected agents
    while IFS= read -r line
    do
    ids=$(echo $line | awk '{print $2}')
    status=$(echo $line | awk '{ if (NF > 1) print $(NF-1),$NF ; else print $NF; }')

    if [ "$status" == "Never connected" ]; then
       echo $ids >> remove.txt
    fi

    done < "$file"

#Remove commas 
    sed 's/.$//' remove.txt > removed.txt

#Remove agents with IDs in removed.txt file
    file2=removed.txt

    while IFS= read -r line
    do
    /var/ossec/bin/manage_agents -r "$line"
    done < $file2

#Restart OSSEC service
    /var/ossec/bin/ossec-control restart
#End