Wazuh 4.2 Office 365 python script stops executing after 24 hours

[nbent...@gmail.com]

I'm running Wazuh 4.2 and I have our office 365 python script from Wazuh running every hour collecting audit logs:

<wodle name="command">

  <disabled>no</disabled>

  <command>/var/ossec/bin/office_365.py --contentType DLP.All Audit.General Audit.AzureActiveDirectory --hours 1 --tenantId  $$$$$   --clientId  $$$$$  --clientSecret $$$$$ </command>

  <interval>1h</interval>

  <ignore_output>yes</ignore_output>

  <run_on_start>yes</run_on_start>

  <timeout>0</timeout>

  <tag>Office 365 Events</tag>

</wodle>

I noticed the events were not coming in recently so I restarted Wazuh manager at 11:30 PM ET Monday night and this morning I noticed it stopped at 11:30 PM Tuesday.

in the ossec logs there are only notices that it started. What could I enable to get debugging on the script. If I add the --debug $true the script stops with exit code 2.

[nbent...@gmail.com]

Is there anything I can setup to debug why wodle is not executing the script every hour?

[Juan Emiliano Fontana]

Hi Nbentzinger, hope you are doing great today and thanks for using Wazuh!

You can enable the debug for wazuh-modules in the /var/ossec/etc/internal_options.conf, this file is reserved for debugging issues and for troubleshooting.

You need to edit the file and change the wazuh_modules.debug option from 0 to 2 and then restart the Wazuh Manager. This will add a debug level in the ossec.log file for the specified module. You will find more information about the internal options in here.

Regarding the problem that you are having with the Office 365 script, the problem started after an upgrade of Wazuh? If you restart the Wazuh Manager, the script executes and pull the logs from Office 365? Or you are not getting any log at all?

Let me know.

Regards!

--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/92f09da6-2786-4791-8f05-16371eb34b9fn%40googlegroups.com.

[Reetaes purbey]

Hi All,

After the upgrade Wazuh manager not able to fetch the 365 any data.

Regards,