First commit, including plugins in repository

check_bro.sh

@@ -0,0 +1,336 @@
+#!/usr/bin/env bash
+
+# Author: Jon Schipp
+# Date: 11-08-2013
+########
+# Examples:
+
+# 1.) Check status of all Bro workers
+# $ ./check_bro.sh -f /usr/local/bro-2.2/bin/broctl -T status
+
+# 2.) Return average packet loss for the 3 named bro workers
+# $ ./check_bro.sh -T loss -i "nids0,nids1,nids2"
+
+# 3.) Check average packet loss of all bro workers against warning and critical thresholds i.e > 10% or 20% packet loss.
+# $ ./check_bro.sh -T loss -i all -w 10 -c 20
+
+# 4.) Check packet loss percentage for the last most recent interval from Bro's capture_loss.log above 10% loss.
+# $ ./check_bro.sh -f /usr/local/bro-2.2/logs/current/capture_loss.log -T capture_loss -c 10
+
+# 5.) Check average packet loss reported by Myricom's SnifferG driver for each Bro node.
+# $ ./check_bro.sh -T myricom -i "192.168.1.254,192.168.1.253" -u bro
+
+# Nagios Exit Codes
+OK=0
+WARNING=1
+CRITICAL=2
+UNKNOWN=3
+
+# Default location of broctl
+# Set this to the proper location if your installation differs or use ``-f''
+BROCTL=/usr/local/bro/bin/broctl
+
+# Default location of myri_counters
+# Set this to the proper location if your installation differs
+MYRI_COUNTERS=/opt/snf/bin/myri_counters
+
+# Default location of capture_loss.log
+# Set this to the proper location if your installation differs
+CAPTURE_LOG=/usr/local/bro/logs/current/capture_loss.log
+
+usage()
+{
+cat <<EOF
+
+Check status of Bro and Bro workers.
+This script should be run on the Bro manager.
+
+     Options:
+        -c <int>                Critical threshold as percent of packet loss
+        -f <path>               Set optional absolute path for broctl, myri_counters, or capture_loss.log (Use as first option)
+                                (def: $BROCTL, $MYRI_COUNTERS, $CAPTURE_LOG)
+        -i <node/worker>        Identifier for Bro instance(s). IP, FQDN, or name depending on the check. (sep:, )
+        -p <name>               Print the value of data from Bro e.g. Notice::suppressing or capture_filter
+        -T <type>               Check type, "status/loss/capture_loss/myricom/print"
+                                status - Check status of all Bro workers
+                                loss   - Average packet loss by name for a single-
+					(\`\`-i nids01''), set (\`\`-i "nids01,nids02"), or all workers (\`\`-i all'').
+                                capture_loss - Checks for packet loss in capture_loss.log
+                                myricom - Average Myricom Sniffer driver packet loss by IP or FQDN for a single-
+					 (\`\`-i 192.168.1.1'') or set (\`\`-i "192.168.1.1,192.168.1.2") of Bro nodes
+                                         Connects to nodes via SSH (pub-key auth). If username is not root use ``-u''.
+                                print   - Print Bro values 
+        -u <user>               Username for the myricom check (def: root)
+        -w <int>                Warning threshold as percent of packet loss
+
+Usage: $0 -f /usr/local/bro-dev/bin/brotcl -T status
+$0 -f /usr/local/bro-2.2/logs/current/capture_loss.log -T capture_loss -c 20 
+EOF
+}
+
+argcheck() {
+# if less than n argument
+if [ $ARGC -lt $1 ]; then
+        echo "Missing arguments! Use \`\`-h'' for help."
+        exit 1
+fi
+}
+
+# Initialize variables
+CRIT=0
+WARN=0
+LIST_NODES=0
+LOSS_CHECK=0
+CAPTURE_LOSS_CHECK=0
+STATUS_CHECK=0
+PRINT_CHECK=0
+MYRI_CHECK=0
+MYRI_STATS=0
+USER=root
+LOSS=0
+RECV=0
+RUNNING=0
+STOPPED=0
+CRASHED=0
+UNKNOWN=0
+WORKERS=all
+EXCLUDE=none
+ARGC=$#
+
+argcheck 1
+
+while getopts "hfc:i:lm:p:T:u:w:" OPTION
+do
+
+     case $OPTION in
+         h)
+             usage
+             ;;
+         f)
+             shift
+             if [[ $1 == *broctl ]]; then
+                BROCTL="$1"
+             elif [[ $1 == *myri_counters ]]; then
+                MYRI_COUNTERS=$1
+             elif [[ $1 == *capture_loss.log ]]; then
+                CAPTURE_LOG=$1  
+             else
+                echo "File name appears to be incorrect, maybe try setting the approprate variable in $0."
+             fi
+             ;;
+         c)
+             CHECK_THRESHOLD=1
+             CRIT="$OPTARG"
+             ;;
+         l)
+            LIST_NODES=1
+            ;; 
+         i)
+             if [ $LOSS_CHECK -eq 1 ] && [[ "$OPTARG" == all ]]; then
+                     WORKERS=".*"
+             elif [ $LOSS_CHECK -eq 1 ]; then    
+                     WORKERS=$(echo "$OPTARG" | sed 's/,/:\\|/g')
+             elif [ $MYRI_CHECK -eq 1 ]; then
+                     NODE=$(echo "$OPTARG" | sed 's/,/ /g')
+             else 
+                     echo "ERROR: Argument is in incorrect format or \`\`-T <type>'' was not specified first"
+                     exit $UNKOWN
+             fi
+             ;;
+         p)
+                PRINT="$OPTARG"
+                ;;
+         T)
+             if [[ "$OPTARG" == status ]]; then
+                        STATUS_CHECK=1 
+             elif [[ "$OPTARG" == myricom ]]; then
+                        MYRI_CHECK=1
+             elif [[ "$OPTARG" == loss ]]; then
+                        LOSS_CHECK=1
+             elif [[ "$OPTARG" == capture_loss ]]; then
+                        CAPTURE_LOSS_CHECK=1
+             elif [[ "$OPTARG" == print ]]; then
+                        PRINT_CHECK=1
+             else
+                        echo "Unknown argument type"
+                        exit $UNKNOWN
+             fi
+             ;;
+         u)
+             USER="$OPTARG"
+             ;;
+         w)
+             WARN="$OPTARG"
+             ;;
+         \?)
+             exit 1
+             ;;
+     esac
+done
+
+if [ $LOSS_CHECK -eq 1 ] || [ $STATUS_CHECK -eq 1 ] || [ $LIST_NODES -eq 1 ] || [ $PRINT_CHECK -eq 1 ] ; then
+
+        if [ ! -f $BROCTL ];
+        then
+                 echo "ERROR: Broctl has not been found. Update the BROCTL variable in $0 or specify the path with \`\`-f''"
+                 exit 1
+        fi
+fi
+
+if [ $LIST_NODES -eq 1 ]; then
+        $BROCTL nodes
+        exit $OK
+fi
+
+if [ $LOSS_CHECK -eq 1 ]; then
+       
+ # Total average packet loss as a percent for specified workers
+
+FLOAT_LOSS=$($BROCTL netstats | grep "$WORKERS" | sed 's/[a-z]*=//g' | awk '{ drop += $4 ; link += $5 } END { printf("%f\n", ((drop/NR) / (link/NR))* 100) }')
+LOSS=$(/usr/bin/printf "%d\n" $FLOAT_LOSS 2>/dev/null)
+
+        if [ $LOSS -gt $CRIT ] ;then
+                
+                echo "Average packet loss is: $FLOAT_LOSS"
+                exit $CRITICAL
+
+        elif [ $LOSS -gt $WARN ]; then
+                
+                echo "Average packet loss is: $FLOAT_LOSS"
+                exit $WARNING
+        else 
+                echo "Average packet loss is: $FLOAT_LOSS"
+                exit $OK
+        fi
+fi
+
+ # Check status of Bro workers
+
+if [ $STATUS_CHECK -eq 1 ]; then
+
+# Broctl stderr is whitespace separated and we need to match on entire line
+IFS=$'\n'
+
+        for line in $($BROCTL status 2>&1 | grep -v Name)
+        do      
+                NAME=$(echo "$line" | awk '{ print $1 }')
+                case "$line" in 
+                *stop*)
+                        echo "$NAME has stopped"
+                        STOPPED=$((STOPPED+1))
+                        ;; 
+                *fail*)
+                        echo "$NAME has crashed"
+                        CRASHED=$((CRASHED+1))
+                        ;; 
+                *run*)
+                        echo "$NAME is running"
+                        RUNNING=$((RUNNING+1))
+                        ;;
+                *)
+                        echo "Unknown status of worker: $NAME"
+                        UNKNOWN=$((UNKNOWN+1))
+                        ;;
+                esac
+        done
+        
+        if [ $STOPPED -gt 0 ] || [ $CRASHED -gt 0 ] || [ $UNKNOWN -gt 0 ]; then
+                echo "-> $STOPPED stopped workers, $CRASHED crashed workers, $RUNNING running workers, and $UNKNOWN workers with an unknown status"
+                exit $CRITICAL
+        else 
+                echo "All $RUNNING instances are running!"
+                exit $OK
+        fi
+        
+fi
+
+if [ $CAPTURE_LOSS_CHECK -eq 1 ]; then
+        
+        if [ ! -f $CAPTURE_LOG ]; then
+                echo "capture_loss.log cannot be found, modify CAPTURE_LOG in $0 or use \`\`-f''"
+                exit $UNKNOWN
+        fi
+        
+        INTERVAL=$(awk 'NR == 9 { printf("%d\n", $2) }' $CAPTURE_LOG)
+        TIME=$(date +"%s")
+        RECENT=$(echo $((TIME-INTERVAL)))
+
+        awk -v recent=$RECENT -v crit=$CRIT -v loss=0 -v threshold=0 '! /^#/ && $1 > recent && $4 > 0 \
+                 { 
+                        loss++; decimal=sprintf("%d", $6); 
+                        if ( strtonum(decimal) > crit ) {
+				threshold++
+                                print "Peer: "$3,"\t","Loss:", $6;
+			}
+                 }
+
+                END { 
+                        if ( loss >= 1 ) { 
+				print "\n--------------------\n"loss,"instances of loss with",threshold,"exceeding the threshold ("crit"%).";
+                                exit 2 
+                        }
+                else
+                         print "\nNo loss detected"; }' $CAPTURE_LOG
+
+        if [ $? -eq 2 ]; then
+                exit $CRITICAL
+        elif [ $? -eq 0 ]; then
+                exit $OK
+        else
+                echo "Unknown status code: $?"
+                exit $UNKNOWN
+        fi      
+fi
+
+if [ $PRINT_CHECK -eq 1 ]; then
+
+        $BROCTL print $PRINT
+        
+        exit $OK
+fi
+
+if [ $MYRI_CHECK -eq 1 ]; then
+
+LOSS=0
+RECV=0
+COUNT=0
+LOSS_TOT=0
+RECV_TOT=0
+AVERAGE=0
+
+        if [ ! -f $MYRI_COUNTERS ]; then
+                echo "ERROR: myri_counters has not been found. Update the MYRI_COUNTERS variable in $0 or specify the path with \`\`-f''"
+                exit $UNKOWN
+        fi
+        
+        for node in $NODE
+        do
+                MYRI_STATS=$(ssh -l $USER $node $MYRI_COUNTERS | awk -F : '/SNF drop ring full|SNF recv pkts/ { print $2 }' | sed 's/[ \t]*//')
+                RECV=$(echo $MYRI_STATS | awk '{ print $1 }')
+                LOSS=$(echo $MYRI_STATS | awk '{ print $2 }')
+                LOSS_TOT=$((LOSS+LOSS_TOT))
+                RECV_TOT=$((RECV+RECV_TOT))
+                COUNT=$((COUNT+1))
+                echo "$node: Lost $LOSS of $RECV"
+        done
+        
+        echo "--------------------"
+        
+        # Average       
+        FLOAT_LOSS=$(echo "(($LOSS_TOT / $COUNT) / ($RECV_TOT / $COUNT)) * 100" | bc -l)
+        LOSS=$(/usr/bin/printf "%d\n" $FLOAT_LOSS 2>/dev/null)
+        
+        if [ $LOSS -gt $CRIT ]; then
+                
+                echo "Average packet loss is: $FLOAT_LOSS"
+                exit $CRITICAL
+
+        elif [ $LOSS -gt $WARN ]; then
+                
+                echo "Average packet loss is: $FLOAT_LOSS"
+                exit $WARNING
+        else 
+                echo "Average packet loss is: $FLOAT_LOSS"
+                exit $OK
+        fi
+fi

check_file_growth.sh

@@ -0,0 +1,175 @@
+#!/usr/bin/env bash
+
+# Author: Jon Schipp
+# Date: 11-07-2013
+########
+# Examples:
+
+# 1.) Check if file has grown in the last 30 seconds
+# $ ./check_file_growth.sh -f /var/log/system.log -M stat -i 30
+#  File grew by 118 bytes
+#
+# 2.) If file has grown by more than (c)ritical or (w)arning bytes in 30 seconds exit with critical or warning status
+# $ ./check_file_growth -f big.log -M stat -T bigger -c 1000000 -w 5000000 -i 30
+
+# Nagios Exit Codes
+OK=0
+WARNING=1
+CRITICAL=2
+UNKNOWN=3
+
+usage()
+{
+cat <<EOF
+
+Check the level of byte growth of a file for a time interval.
+Also, check that a file is growing.
+
+     Options:
+        -f           Specify filename as full path
+	-i <int>     Interval in seconds
+	-M <command> Command to use for the checks
+	       	     "wc/stat" wc is portable but slower, stat is faster but less portable
+	-T <type>    Type of concern for thresholds
+		     "bigger/smaller" than thresholds
+        -c <int>     Critical threshold in bytes
+        -w <int>     Warning threshold in bytes
+
+Usage: $0 -f big.log -M stat -T bigger -c 1000000 -w 5000000 -i 30
+EOF
+}
+
+if [ $# -lt 4 ]; 
+then
+	usage
+	exit 1
+fi
+
+# Define now to prevent expected number errors
+FILE=/dev/null
+TYPE=bigger
+CONCERN=0
+TIME=0
+CRIT=0
+WARN=0
+NEW=0
+OLD=0
+GROWTH=0
+PROG=wc
+OS=$(uname)
+
+while getopts "hc:f:i:M:T:w:" OPTION
+do
+     case $OPTION in
+         h)
+	     usage
+             ;;
+         c)
+	     CRIT="$OPTARG"
+             ;;
+	 f)
+	     FILE="$OPTARG"
+	     ;;
+	 i) 
+	     TIME="$OPTARG"
+	     ;;
+	 M)
+	     PROG="$OPTARG"
+	     if [[ "$OPTARG" == stat ]]; then
+            	PROG="$OPTARG"
+             elif [[ "$OPTARG" == wc ]]; then
+             	PROG="$OPTARG"
+             else
+             	echo "Unknown argument to \`\`-M''! Choose wc or stat."
+             	exit 1
+	     fi
+	     ;;
+         v)
+             FILE="$OPTARG"
+             ;;
+	 T)
+	     CONCERN=1
+	     if [[ "$OPTARG" == bigger ]]; then
+            	TYPE="$OPTARG"
+             elif [[ "$OPTARG" == smaller ]]; then
+             	TYPE="$OPTARG"
+             else
+             	echo "Unknown type!"
+             	exit 1
+             fi
+	     ;;
+	 w) 
+	     WARN="$OPTARG"
+	     ;;
+         \?)
+             exit 1
+             ;;
+     esac
+done
+
+if [ ! -f $FILE ]; then
+	echo "File doesn't exist or is not a regular file!"
+	exit $UNKNOWN
+fi
+
+if [ $PROG == stat ] && [[ $OS != AIX ]]; then
+
+	if [[ $OS == Linux ]]; then
+		OLD=$(stat -c %s $FILE)
+		sleep $TIME
+		NEW=$(stat -c %s $FILE)
+	else
+		OLD=$(stat -f %z $FILE)
+		sleep $TIME
+		NEW=$(stat -f %z $FILE)
+	fi
+else
+	OLD=$(wc -c $FILE | awk '{ print $1}')
+	sleep $TIME
+	NEW=$(wc -c $FILE | awk '{ print $1}')
+fi
+
+GROWTH=$(($NEW-$OLD))
+
+if [ $CONCERN -eq 0 ]; then 
+
+	if [ $GROWTH -gt 0 ]; then
+		echo "File grew by $GROWTH bytes"
+		exit $OK
+	else
+		echo "File hasn't grown"
+		exit $CRITICAL
+	fi
+
+fi
+
+if [ $CONCERN -eq 1 ]; then
+
+	if [ $TYPE == "bigger" ]; then
+
+		if [ $GROWTH -ge $CRIT ]; then
+			echo "File grew by $GROWTH bytes in ${TIME} seconds"
+			exit $CRITICAL
+		elif [ $GROWTH -ge $WARN ]; then
+			echo "File grew by $GROWTH bytes in ${TIME} seconds"
+			exit $WARNING
+		else
+			echo "File grew by $GROWTH bytes in ${TIME} seconds"
+			exit $OK
+		fi   
+	fi
+
+	if [ $TYPE == "smaller" ]; then
+
+		if [ $GROWTH -le $CRIT ]; then
+			echo "File grew by $GROWTH bytes in ${TIME} seconds"
+			exit $CRITICAL
+		elif [ $GROWTH -le $WARN ]; then
+			echo "File grew by $GROWTH bytes in ${TIME} seconds"
+			exit $WARNING
+		else
+			echo "File grew by $GROWTH bytes in ${TIME} seconds"
+			exit $OK
+		fi
+	fi
+fi

check_load.sh

@@ -0,0 +1,187 @@
+#!/usr/bin/env bash
+
+# Author: Jon Schipp
+
+########
+# Examples:
+
+# 1.) Check system load with autodetect OS and CPU's to determine thresholds
+# $ ./check_load.sh -a
+
+# Nagios Exit Codes
+OK=0
+WARNING=1
+CRITICAL=2
+UNKNOWN=3
+
+usage()
+{
+cat <<EOF
+
+Check system load for Linux, FreeBSD, OSX, and AIX.
+
+     Options:
+
+	-a		Autodetect OS and CPUs
+	-c <int> 	Critical threshold
+	-o <os>		OS type, "linux/osx/freebsd/aix"
+	-p <int>	Specify number of CPUs
+	-w <int>	Warning threshold
+
+Usage:$0 -a
+EOF
+}
+
+argcheck() {
+# if less than n argument
+if [ $ARGC -lt $1 ]; then
+	echo "Missing arguments! Use \`\`-h'' for help."
+	exit 1
+fi
+}
+
+determine_cpus() {
+
+if [[ $OS == linux ]]; then
+	CORES=$(nproc)
+fi
+
+if [[ $OS == freebsd ]]; then
+	CORES=$(sysctl -n hw.ncpu)
+fi
+
+if [[ $OS == osx ]]; then
+	CORES=$(sysctl -n hw.ncpu)
+fi
+
+if [[ $OS == aix ]]; then
+	CORES=$(lparstat -i | awk -F : '/Active Physical CPUs/ { print $2 }')
+fi
+}
+
+determine_command () {
+
+if [[ "$OS" == osx ]]; then
+	UPTIME=$(uptime | awk -F : '{ print $4 }')
+elif [[ "$OS" == linux ]]; then
+	UPTIME=$(uptime | awk -F : '{ print $5 }' | sed 's/,//g')
+elif [[ "$OS" == freebsd ]]; then
+	UPTIME=$(uptime | awk -F : '{ print $4 }' | sed 's/,//g')
+elif [[ "$OS" == aix ]]; then
+	UPTIME=$(uptime | awk -F : '{ print $4 }' | sed 's/,//g')
+else 
+	echo "OS not supported"
+	exit $UNKNOWN
+fi
+}
+auto_os_detect() {
+
+UNAME=$(uname)
+
+ if [[ "$UNAME" == Linux ]]; then
+        OS="linux"
+ elif [[ "$UNAME" == Darwin ]]; then
+        OS="osx"
+ elif [[ "$UNAME" == Freebsd ]]; then
+        OS="freebsd"
+ elif [[ "$UNAME" == AIX ]]; then
+        OS="aix"
+ else
+        echo "Unsupported OS type!"
+        exit 1
+ fi  
+
+}
+
+ARGC=$#
+CRIT=0
+WARN=0
+THRESHOLD=0
+LOAD=0
+AUTO_DETECT=0
+CORES=0
+OS=null
+CRIT_STATUS=0
+WARN_STATUS=0
+OK_STATUS=0
+
+argcheck 1
+
+while getopts "hac:o:p:" OPTION
+do
+     case $OPTION in
+         h)
+             usage
+	     exit 0
+             ;;
+	 a)
+	     AUTO_DETECT=1
+	     auto_os_detect
+	     determine_cpus
+	     ;;
+	 c)
+	     CRIT="$OPTARG"
+	     THRESHOLD=1
+             ;;
+	 o)
+	     echo "Need to implement \`\`-o'' yet"
+	     exit 1
+	     ;;
+	 p)
+	     CORES="$OPTARG"
+	     ;;
+	 w)
+	     WARN="$OPTARG"
+	     THRESHOLD=1
+	     ;;
+         \?)
+             exit 1
+             ;;
+     esac
+done
+
+determine_command
+
+if [ $THRESHOLD -eq 0 ]; then
+
+	for load in $UPTIME
+	do
+		LOAD=$(/usr/bin/printf "%d\n" $load 2>/dev/null)
+
+		if [ $LOAD -gt $CORES ]; then
+			CRIT_STATUS=$((CRIT_STATUS+1))
+		elif [ $LOAD -gt $CORES ]; then
+			WARN_STATUS=$((WARN_STATUS+1))
+		else
+			OK_STATUS=$((OK_STATUS+1))
+		fi
+	done
+
+fi
+
+if [ $THRESHOLD -eq 1 ]; then
+
+	for load in $UPTIME
+	do
+		LOAD=$(/usr/bin/printf "%d\n" $load 2>/dev/null)
+
+		if [ $LOAD -gt $CRIT ]; then
+			CRIT_STATUS=$((CRIT_STATUS+1))
+		elif [ $LOAD -gt $WARN ]; then
+			WARN_STATUS=$((WARN_STATUS+1))
+		else
+			OK_STATUS=$((OK_STATUS+1))
+		fi	
+	done
+fi
+
+if [ $CRIT_STATUS -gt 0 ]; then
+	echo "Load average critical: $UPTIME"
+	exit $CRITICAL
+elif [ $WARN_STATUS -gt 0 ]; then
+	echo "Load average warning: $UPTIME"
+	exit $WARNING
+else 
+	echo "Load average: $UPTIME"
+	exit $OK
+fi

check_ossec.sh

@@ -0,0 +1,191 @@
+#!/usr/bin/env bash
+
+# Author: Jon Schipp
+
+########
+# Examples:
+
+# 1.) Check status of OSSEC services excluding active response i.e. execd
+# $ ./check_ossec.sh -s execd
+
+# 2.) Check status of OSSEC agent
+# $ ./check_ossec.sh -a server1
+
+# 3.) Check status of multiple OSSEC agents
+# $ ./check_ossec.sh -a "server1,server2,station3"
+
+# 4.) Report critical if more than 3 agents are offline and warning if at least 1 is offline.
+# $ ./check_ossec.sh -c 3 -w 1
+
+# Nagios Exit Codes
+OK=0
+WARNING=1
+CRITICAL=2
+UNKNOWN=3
+
+# Default Location of the binaries (Modified to /usr/ossec for TOC)
+# Set these to the proper location if your installation differs
+AGENT_CONTROL=/usr/ossec/bin/agent_control
+OSSEC_CONTROL=/usr/ossec/bin/ossec-control
+
+if [ ! -f $AGENT_CONTROL ] && [ ! -f $OSSEC_CONTROL ];
+then
+	echo "ERROR: OSSEC binaries not found. If you installed OSSEC in a location other than the default update the AGENT_CONTROL and OSSEC_CONTROL variables in $0."
+	exit 1
+fi
+
+usage()
+{
+cat <<EOF
+
+Check for status of OSSEC agents and server.
+This script should be run on the OSSEC server.
+
+     Options:
+        -a <name>       Check status of agent or list of comma separated agents, "agent1,agent2".
+        -c <int>        Critical threshold for number of inactive agents
+        -l              List all agents
+        -s <service>    Check status of OSSEC server processes. Use ``-s all'' to check all.
+                        To exclude a service e.g execd pass as argument i.e. ``-s execd''
+        -w              Warning threshold for number of inactive agents
+
+Usage: $0 -a "server1,server2,station3"
+EOF
+}
+
+argcheck() {
+# if less than n argument
+if [ $ARGC -lt $1 ]; then
+        echo "Missing arguments! Use \`\`-h'' for help."
+        exit 1
+fi
+}
+
+# Initialize variables
+CRIT=0
+WARN=0
+CHECK_AGENT=0
+CHECK_THRESHOLD=0
+LIST_AGENTS=0
+SERVER_CHECK=0
+EXCLUDE=all
+ACTIVE=0
+INACTIVE=0
+NEVER=0
+TOTAL=0
+DISCONNECTED=0
+CONNECTED=0
+NEVERCONNECTED=0
+UNKNOWN=0
+ARGC=$#
+
+argcheck 1
+
+while getopts "ha:c:ls:v:w:" OPTION
+do
+     case $OPTION in
+         h)
+             usage
+             ;;
+         a)
+             CHECK_AGENT=1
+             AGENT="$OPTARG"
+             ;;
+         c)
+             CHECK_THRESHOLD=1
+             CRIT="$OPTARG"
+             ;;
+         l)
+             LIST_AGENTS=1
+             ;;
+         s)
+             SERVER_CHECK=1
+             EXCLUDE="$OPTARG"
+             ;;
+         v)
+             CHECK_THRESHOLD=1
+             VOL="$OPTARG"
+             ;;
+         w) 
+             WARN="$OPTARG"
+             ;;
+         \?)
+             exit 1
+             ;;
+     esac
+done
+
+if [ $LIST_AGENTS -eq 1 ]; then
+        $AGENT_CONTROL -l
+        exit 0
+fi
+
+if [ $SERVER_CHECK -eq 1 ]; then
+        
+        $OSSEC_CONTROL status | grep -v $EXCLUDE | grep "not running"
+
+        if [ $? -eq 0 ]; then
+                echo "An OSSEC service is not running!"
+                exit $CRITICAL
+        else
+                echo "All OSSEC services running"
+                exit $OK
+        fi
+fi
+
+if [ $CHECK_AGENT -eq 1 ]; then
+
+        for host in $(echo $AGENT | sed 's/,/ /g'); 
+        do
+                RESULT=$($AGENT_CONTROL -l | grep ${host},)
+
+                case $RESULT in
+
+                *Disconnected)
+                        echo "Agent $host is not connected!"
+                        DISCONNECTED=$((DISCONNECTED+1))
+                        ;; 
+                *Active)
+                        echo "Agent $host is connected"
+                        CONNECTED=$((CONNECTED+1))
+                        ;;
+                *Never*) 
+                        echo "Agent $host has never connected to the server: $RESULT"
+                        NEVERCONNECTED=$((NEVERCONNECTED+1))
+                        ;;
+                *)
+                        echo "Unknown status or agent: $host"
+                        UNKNOWN=$((UNKNOWN+1))
+                        ;;
+                esac
+        done
+        
+        if [ $DISCONNECTED -gt 0 ] || [ $NEVERCONNECTED -gt 0 ] || [ $UNKNOWN -gt 0 ]; then
+                echo "-> $DISCONNECTED disconnected agent(s), $NEVERCONNECTED never connected agent(s), and $UNKNOWN agent(s) with unknown status (possible agent name typo?)."
+                exit $CRITICAL
+        else 
+                echo "All requested ($CONNECTED) agents are connected to the server!"
+                exit $OK
+        fi
+fi
+
+
+if [ $CHECK_THRESHOLD -eq 1 ]; then
+        
+        ACTIVE=$($AGENT_CONTROL -l | grep Active | wc -l)
+        INACTIVE=$($AGENT_CONTROL -l | grep Disconnected | wc -l)
+        NEVER=$($AGENT_CONTROL -l | grep Never | wc -l)
+        TOTAL=$($AGENT_CONTROL -l | wc -l)
+
+        if [ $INACTIVE -gt $CRIT ]; then
+                echo "$INACTIVE of $TOTAL agents inactive! Active: $ACTIVE"
+                exit $CRITICAL
+        elif [ $INACTIVE -gt $WARN ]; then
+                echo "$INACTIVE of $TOTAL agents inactive! Active: $ACTIVE"
+                exit $WARNING
+        else
+                echo "Active: $ACTIVE - Inactive: $INACTIVE - Never connected:$NEVER - Total: $TOTAL"
+                exit $OK
+        fi
+
+fi

check_osx_raid.sh

@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+
+# Nagios Exit Codes
+OK=0
+WARNING=1
+CRITICAL=2
+UNKNOWN=3
+
+usage()
+{
+cat <<EOF
+
+Check the RAID status for disks on OSX.
+
+     Options:
+       -l 	      List full RAID information
+       -c	      Check RAID status
+
+Usage: $0 -c
+EOF
+}
+
+argcheck() {
+# if less than n argument
+if [ $ARGC -lt $1 ]; then
+        echo "Missing arguments! Use \`\`-h'' for help."
+        exit 1
+fi
+}
+
+RAID_CHECK=0
+ARGC=$#
+
+argcheck 1
+
+while getopts "hlc" OPTION
+do
+     case $OPTION in
+         h)
+	     usage
+             ;;
+	 c)
+	     RAID_CHECK=1
+	     ;;
+	 l) 
+	     diskutil appleRAID list
+	     exit $OK
+	     ;;
+         \?)
+             exit $UNKNOWN
+             ;;
+     esac
+done
+
+if [ $RAID_CHECK -eq 1 ]; then
+
+STATUS_ROW=$(diskutil appleRAID list | awk '/^Status:/ { print $2 }')
+DISK=$(diskutil appleRAID list | awk '/disk.*Fail/ { print $2 }')
+STATUS=$(diskutil appleRAID list | grep ^[0-9])
+
+case $STATUS in
+
+*[fF]ailed*)
+	echo "$DISK Failure: $STATUS_ROW array!"
+	exit $CRITICAL
+	;;
+*[oO]ffline*)
+	echo "$DISK Failure: $STATUS_ROW array!"
+	exit $CRITICAL
+	;;
+*[dD]egraded*)
+	echo "$DISK Failure: $STATUS_ROW array!"
+	exit $CRITICAL
+	;;
+*[oO]nline*)
+	echo "RAID array is online."
+	exit $OK
+	;;
+*)	
+	echo "Unknown status for: $STATUS"
+	exit $UNKNOWN	
+	;;
+esac
+
+fi

check_osx_smart.sh

@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+
+# Nagios Exit Codes
+OK=0
+WARNING=1
+CRITICAL=2
+UNKNOWN=3
+
+usage()
+{
+cat <<EOF
+
+Check the S.M.A.R.T status for a disk on OSX.
+
+     Options:
+       -d <disk>      Specify volume a disk
+       -l 	      List available disks
+
+Usage: $0 -d disk0
+EOF
+}
+
+argcheck() {
+# if less than n argument
+if [ $ARGC -lt $1 ]; then
+        echo "Missing arguments! Use \`\`-h'' for help."
+        exit 1
+fi
+}
+
+CHECK=0
+ARGC=$#
+
+argcheck 1
+
+while getopts "hld:" OPTION
+do
+     case $OPTION in
+         h)
+	     usage
+             ;;
+	 l)
+	     diskutil list
+	     exit 0
+	     ;;
+	 d)
+	     CHECK=1
+	     DISK="$OPTARG"
+	     ;;
+         \?)
+             exit 1
+             ;;
+     esac
+done
+
+if [ $CHECK -eq 1 ]; then
+
+	if [ -b /dev/${DISK} ]; then
+		STATUS=$(diskutil info $DISK | awk '/SMART/ { print $3 }')
+	else
+		echo "$DISK is not a valid block device"
+	exit 3
+	fi
+
+	case $STATUS in
+
+	[vV]erified)
+		echo "Disk $DISK is OK."
+		exit $OK
+		;;
+	*[nN]ot*)
+		echo "SMART status is not supported for this disk (e.g. externals): $DISK"
+		exit $OK
+		;;
+	*[fF]ail*)
+		echo "Disk $DISK is failing."
+		exit $CRITICAL
+		;;
+	*)
+		echo "Unknown status for $DISK: $STATUS"
+		exit $UNKNOWN
+		;;
+	esac
+
+fi

check_osx_temp.sh

@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+
+# Monitor temperatures in OSX
+# Depends on the installation of TemperatureMonitor from www.bresink.com/osx/TemperatureMonitor.html
+
+# Nagios Exit Codes
+OK=0
+WARNING=1
+CRITICAL=2
+UNKNOWN=3
+
+usage()
+{
+cat <<EOF
+
+Check the temperature sensors on OSX
+
+     Options:
+       -t	Monitor tempatures
+       -c	Critical threshold in Fahrenheit
+
+Usage: $0 -t -c 180
+EOF
+}
+
+argcheck() {
+# if less than n argument
+if [ $ARGC -lt $1 ]; then
+        echo "Missing arguments! Use \`\`-h'' for help."
+        exit 1
+fi
+}
+
+MONITOR=0
+CRIT=0
+WARN=0
+COMMAND="/Applications/TemperatureMonitor.app/Contents/MacOS/tempmonitor -ds -f -a -l"
+ARGC=$#
+
+argcheck 1
+
+if ! [ -f /Applications/TemperatureMonitor.app/Contents/MacOS/tempmonitor ]; then
+	echo "tempmonitor not found. Install package from www.bresink.com/osx/TemperatureMonitor.html"
+	exit $UNKNOWN
+fi
+
+while getopts "htc:" OPTION
+do
+     case $OPTION in
+         h)
+	     usage
+             ;;
+	 t) 
+	     MONITOR=1
+	     ;;
+	 c) 
+	     CRIT="$OPTARG"
+	     ;;
+	 w) 
+	     WARN="$OPTARG"
+	     ;;
+         \?)
+             exit 1
+             ;;
+     esac
+done
+
+if [ $MONITOR -eq 1 ]; then
+	$COMMAND | sed 's/ F//' | awk -v crit=$CRIT -F : \
+	'$2 > crit { high=1; print $0 }
+	END { 
+	if (high == 1) { 
+		exit 2 
+	} else { 
+		exit 0 
+		}
+	}'
+
+	if [ $? -eq 2 ]; then
+		exit $CRITICAL
+	else
+		echo "No high temperatures"
+		exit $OK
+	fi
+fi

check_service.sh

@@ -0,0 +1,266 @@
+#!/usr/bin/env bash
+
+# Author: Jon Schipp
+
+########
+# Examples:
+
+# 1.) List services for osx
+# $ ./check_service.sh -l -o osx
+#
+# 2.) Check status of SSH service on a linux machine
+# $ ./check_service.sh -o linux -s sshd
+
+# 3.) Manually select service management tool and service
+# $ ./check_service.sh -o linux -t "service rsyslog status"
+
+# Nagios Exit Codes
+OK=0
+WARNING=1
+CRITICAL=2
+UNKNOWN=3
+
+usage()
+{
+cat <<EOF
+
+Check status of system services for Linux, FreeBSD, OSX, and AIX.
+
+     Options:
+        -s <service>    Specify service name
+        -l              List services
+        -o <os>         OS type, "linux/osx/freebsd/aix"
+        -u <user>       User if you need to ``sudo -u'' for launchctl (def: nagios, osx only)
+        -t <tool>       Manually specify service management tool (def: autodetect) with status and service
+                        e.g. ``-t "service nagios status"''
+                        
+
+EOF
+}
+
+argcheck() {
+# if less than n argument
+if [ $ARGC -lt $1 ]; then
+        echo "Missing arguments! Use \`\`-h'' for help."
+        exit 1
+fi
+}
+
+os_check() {
+if [ "$OS" == null ]; then
+echo "Use \`\`-o'' and specify the OS as an argument"
+exit 3
+fi
+}
+
+determine_service_tool() {
+if [[ $OS == linux ]]; then
+        if command -v systemctl >/dev/null 2>&1; then
+                SERVICETOOL="systemctl status $SERVICE"
+                LISTTOOL="systemctl"
+        elif command -v initctl >/dev/null 2>&1; then
+                SERVICETOOL="status $SERVICE"
+                LISTTOOL="initctl list"
+        elif command -v service >/dev/null 2>&1; then
+                SERVICETOOL="service $SERVICE status"
+                LISTTOOL="service --status-all"
+        elif command -v chkconfig >/dev/null 2>&1; then
+                SERVICETOOL=chkconfig
+                LISTTOOL="chkconfig --list"
+        elif [ -f /etc/init.d/$SERVICE ] || [ -d /etc/init.d ]; then
+                SERVICETOOL="/etc/init.d/$SERVICE status | tail -1"
+                LISTTOOL="ls -1 /etc/init.d/"
+        else
+                echo "Unable to determine the system's service tool!"
+                exit 1
+        fi
+fi
+
+if [[ $OS == freebsd ]]; then
+        if command -v service >/dev/null 2>&1; then
+                SERVICETOOL="service $SERVICE status"
+                LISTTOOL="service -l"
+        elif [ -f /etc/rc.d/$SERVICE ] || [ -d /etc/rc.d ]; then
+                SERVICETOOL="/etc/rc.d/$SERVICE status"
+                LISTTOOL="ls -1 /etc/rc.d/"     
+        else
+                echo "Unable to determine the system's service tool!"
+                exit 1
+        fi
+fi
+
+if [[ $OS == osx ]]; then
+        if [ -f /usr/sbin/serveradmin >/dev/null 2>&1 ] && serveradmin list | grep "$SERVICE" 2>&1 >/dev/null; then
+                SERVICETOOL="serveradmin status $SERVICE"
+                LISTTOOL="serveradmin list"
+        elif command -v launchctl >/dev/null 2>&1; then
+                SERVICETOOL="launchctl list | grep -v ^- | grep $SERVICE || echo $SERVICE not running! "
+                LISTTOOL="launchctl list"
+                if [ $(id -u) -eq 0 ]; then
+                        SERVICETOOL="sudo -u $USER launchctl list | grep -v ^- | grep $SERVICE || echo $SERVICE not running! "
+                        LISTTOOL="sudo -u $USER launchctl list"
+                fi
+        elif command -v service >/dev/null 2>&1; then
+                SERVICETOOL="service --test-if-configured-on $SERVICE"
+                LISTTOOL="service list"
+        else
+                echo "Unable to determine the system's service tool!"
+                exit 1
+        fi
+fi
+
+if [[ $OS == aix ]]; then
+        if command -v lssrc >/dev/null 2>&1; then
+                SERVICETOOL="lssrc -s $SERVICE | grep -v Subsystem"
+                LISTTOOL="lssrc -a"
+        else
+                echo "Unable to determine the system's service tool!"
+                exit 1
+        fi
+fi
+}
+
+auto_os_detect() {
+        echo test
+}
+
+ARGC=$#
+LIST=0
+MANUAL=0
+OS=null
+SERVICETOOL=null
+LISTTOOL=null
+SERVICE=".*"
+USER=nagios
+
+argcheck 1
+
+while getopts "hls:o:t:u:" OPTION
+do
+     case $OPTION in
+         h)
+             usage
+             exit 0
+             ;;
+         l)
+             LIST=1
+             ;;
+         s) 
+             SERVICE="$OPTARG"
+             ;;
+         o) 
+             if [[ "$OPTARG" == linux ]]; then
+                     OS="$OPTARG"
+             elif [[ "$OPTARG" == osx ]]; then
+                     OS="$OPTARG"
+             elif [[ "$OPTARG" == freebsd ]]; then
+                     OS="$OPTARG"
+             elif [[ "$OPTARG" == aix ]]; then
+                     OS="$OPTARG"
+             else
+                     echo "Unknown type!"
+                     exit 1
+             fi
+             ;;
+         t)
+             MANUAL=1
+             MANUALSERVICETOOL="$OPTARG"
+             ;;
+         u)
+             USER="$OPTARG"
+             ;;
+         \?)
+             exit 1
+             ;;
+     esac
+done
+
+os_check
+determine_service_tool
+
+if [ $LIST -eq 1 ]; then
+        if [[ $LISTTOOL != null ]]; then 
+                $LISTTOOL
+                exit 0
+        else
+                echo "OS not specified! Use \`\`-o''"
+                exit 2  
+        fi
+fi
+
+if [ $MANUAL -eq 1 ]; then
+SERVICETOOL=$MANUALSERVICETOOL
+fi
+
+# Check the status of a service
+STATUS_MSG=$(eval "$SERVICETOOL" 2>&1)
+
+case $STATUS_MSG in
+
+*stop*)
+        echo "$STATUS_MSG"
+        exit $CRITICAL
+        ;;
+*STOPPED*)
+        echo "$STATUS_MSG"
+        exit $CRITICAL
+        ;;
+*not*running*)
+        echo "$STATUS_MSG"
+        exit $CRITICAL
+        ;;
+*running*)
+        echo "$STATUS_MSG"
+        exit $OK
+        ;;
+*RUNNING*)
+        echo "$STATUS_MSG"
+        exit $OK
+        ;;
+*SUCCESS*)
+        echo "$STATUS_MSG"
+        exit $OK
+        ;;
+*[eE]rr*)
+        echo "Error in command: $STATUS_MSG"
+        exit $CRITICAL
+        ;;
+*[eE]nable*)
+        echo "$STATUS_MSG"
+        exit $OK
+        ;;
+*[dD]isable*)
+        echo "$STATUS_MSG"
+        exit $CRITICAL
+        ;;
+*[cC]annot*)
+        echo "$STATUS_MSG"
+        exit $CRITICAL
+        ;; 
+*inactive*)
+        echo "$STATUS_MSG"
+        exit $CRITICAL
+        ;; 
+*dead*)
+        echo "$STATUS_MSG"
+        exit $CRITICAL
+        ;; 
+*[aA]ctive*)
+        echo "$STATUS_MSG"
+        exit $OK
+        ;; 
+*Subsystem*not*on*file)
+        echo "$STATUS_MSG"
+        exit $CRITICAL
+        ;; 
+[1-9][1-9]*)
+        echo "$SERVICE running: $STATUS_MSG"
+        exit $OK
+        ;;
+*)
+        echo "Unknown status: $STATUS_MSG"
+        echo "Is there a typo in the command or service configuration?: $STATUS_MSG"
+        exit $UNKNOWN
+        ;;
+esac
+

check_volume.sh

@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+
+# Nagios Exit Codes
+OK=0
+WARNING=1
+CRITICAL=2
+UNKNOWN=3
+
+usage()
+{
+cat <<EOF
+
+Check the capacity of a volume using df.
+
+     Options:
+        -v         Specify volume as mountpoint
+        -c         Critical threshold as an int (0-100)
+        -w         Warning threshold as an int (0-100)
+	-s 	   Skip threshold checks
+
+Usage: $0 -v /mnt -c 95 -w 90
+EOF
+}
+
+if [ $# -lt 6 ]; 
+then
+	usage
+	exit 1
+fi
+
+# Define now to prevent expected number errors
+VOL=/dev/da0
+CRIT=0
+WARN=0
+SKIP=0
+OS=$(uname)
+
+while getopts "hc:sv:w:" OPTION
+do
+     case $OPTION in
+         h)
+	     usage
+             ;;
+         c)
+	     CRIT="$OPTARG"
+             ;;
+	 s)
+	     SKIP=1
+	     ;;
+         v)
+             VOL="$OPTARG"
+             ;;
+	 w) 
+	     WARN="$OPTARG"
+	     ;;
+         \?)
+             exit 1
+             ;;
+     esac
+done
+
+if [[ $OS == AIX ]]; then
+	STATUS=$(df "$VOL" | awk '!/Filesystem/ { print $4 }' | sed 's/%//')
+	SIZE=$(df -P -m "$VOL" | awk '!/Filesystem/ { print $4 }')
+	USED=$(df -P -m "$VOL" | awk '!/Filesystem/ { print $3 }')
+else
+	STATUS=$(df -h "$VOL" | awk '!/Filesystem/ { print $5 }' | sed 's/%//')
+	SIZE=$(df -h "$VOL" | awk '!/Filesystem/ { print $2 }')
+	USED=$(df -h "$VOL" | awk '!/Filesystem/ { print $3 }')
+fi
+
+if [ $SKIP -eq 1 ]; then
+        echo "$VOL is at ${STATUS}% capacity, $USED of $SIZE (Threshold skipped)"
+        exit $OK
+fi
+
+if [ $STATUS -gt $CRIT ]; then
+        echo "$VOL is at ${STATUS}% capacity! $USED of $SIZE"
+        exit $CRITICAL
+elif [ $STATUS -gt $WARN ]; then
+        echo "$VOL is at ${STATUS}% capacity! $USED of $SIZE"
+        exit $WARNING
+else
+        echo "$VOL is at ${STATUS}% capacity, $USED of $SIZE"
+        exit $OK
+fi