I am running “snort” with two sensors. Occasionally one of my “barnyard2” processes is dying and if I am not checking the processes on the shell, there is no way I’ll know that. So I wrote a single line perl script and put it in a cron job to be run every five minutes. If there are not two barnyard2 processes running, I’m getting an e-mail. Is that simple.
if(`ps -aef |grep barnyard2 |grep -v grep |wc -l`!=2) {`mail -s BY2DOWN me\@email.edu</dev/null`;};
Of course, the whole procedure could be automated, I mean if the script detects the issue, could restart my init.d script controlling barnyard2 (in my case it controls snortd and barnyard2 at the same time) but wth will I do that… Just login and start the process is enough in my case.
So, just decided to share. Put #!/bin/perl on the top of the line above, make it chmod +x or 755, the cron should be */5 * * * * /full/path/by2.check, or something like that. That line should be enough for beginners if any.
jo 