Skip to content

Commit

Permalink
chore: file limit
Browse files Browse the repository at this point in the history
  • Loading branch information
stephane-segning committed Aug 15, 2024
1 parent 1fdb6d5 commit 0f7226a
Show file tree
Hide file tree
Showing 2 changed files with 37 additions and 21 deletions.
2 changes: 1 addition & 1 deletion README.md
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
# Wazuh Yara

[![Test YARA Script](https://github.com/ADORSYS-GIS/wazuh-yara/actions/workflows/build.yml/badge.svg)](https://github.com/ADORSYS-GIS/wazuh-yara/actions/workflows/test-script.yml)
[![Test YARA Script](https://github.com/ADORSYS-GIS/wazuh-yara/actions/workflows/test-script.yml/badge.svg)](https://github.com/ADORSYS-GIS/wazuh-yara/actions/workflows/test-script.yml)
56 changes: 36 additions & 20 deletions scripts/install.sh
Original file line number Diff line number Diff line change
Expand Up @@ -105,6 +105,40 @@ change_owner() {
maybe_sudo chown "$USER:$GROUP" "$path"
}

restart_wazuh_agent() {
case "$(uname)" in
Linux)
if maybe_sudo /var/ossec/bin/wazuh-control restart >/dev/null 2>&1; then
log INFO "Wazuh agent restarted successfully."
else
log ERROR "Error occurred during Wazuh agent restart."
fi
;;
Darwin)
maybe_sudo launchctl unload /Library/LaunchDaemons/com.wazuh.agent.plist
maybe_sudo launchctl load /Library/LaunchDaemons/com.wazuh.agent.plist
;;
*)
log ERROR "Unsupported operating system for restarting Wazuh agent."
exit 1
;;
esac
}

check_file_limit() {
if ! sudo grep -q "<file_limit>" "$OSSEC_CONF_PATH"; then
FILE_LIMIT_BLOCK="<!-- Maximum number of files to be monitored -->\n <file_limit>\n <enabled>no</enabled>\n</file_limit>\n"
# Add the file_limit block after the <disabled>no</disabled> line
maybe_sudo sed -i "/<syscheck>/a $FILE_LIMIT_BLOCK" "$OSSEC_CONF_PATH" || {
error_message "Error occurred during the addition of the file_limit block."
exit 1
}
log INFO "The file limit block was added successfully"
fi
}

#--------------------------------------------#

# Step 1: Install YARA and necessary tools
print_step 1 "Installing YARA and necessary tools..."

Expand Down Expand Up @@ -264,29 +298,11 @@ custom_sed 's/<frequency>43200<\/frequency>/<frequency>300<\/frequency>/g' "$OSS
}
log INFO "Frequency in Wazuh agent configuration file updated successfully."

check_file_limit

# Step 6: Restart Wazuh agent
print_step 6 "Restarting Wazuh agent..."

restart_wazuh_agent() {
case "$(uname)" in
Linux)
if maybe_sudo /var/ossec/bin/wazuh-control restart >/dev/null 2>&1; then
log INFO "Wazuh agent restarted successfully."
else
log ERROR "Error occurred during Wazuh agent restart."
fi
;;
Darwin)
maybe_sudo launchctl unload /Library/LaunchDaemons/com.wazuh.agent.plist
maybe_sudo launchctl load /Library/LaunchDaemons/com.wazuh.agent.plist
;;
*)
log ERROR "Unsupported operating system for restarting Wazuh agent."
exit 1
;;
esac
}

restart_wazuh_agent || {
log ERROR "Error occurred during Wazuh agent restart."
}
Expand Down

0 comments on commit 0f7226a

Please sign in to comment.