Wazuh 4.2 Office 365 python script stops executing after 24 hours

77 views
Skip to first unread message

nbent...@gmail.com

unread,
Sep 15, 2021, 9:18:51 AMSep 15
to Wazuh mailing list
I'm running Wazuh 4.2 and I have our office 365 python script from Wazuh running every hour collecting audit logs:

<wodle name="command">
  <disabled>no</disabled>
  <command>/var/ossec/bin/office_365.py --contentType DLP.All Audit.General Audit.AzureActiveDirectory --hours 1 --tenantId  $$$$$   --clientId  $$$$$  --clientSecret $$$$$ </command>
  <interval>1h</interval>
  <ignore_output>yes</ignore_output>
  <run_on_start>yes</run_on_start>
  <timeout>0</timeout>
  <tag>Office 365 Events</tag>
</wodle>

I noticed the events were not coming in recently so I restarted Wazuh manager at 11:30 PM ET Monday night and this morning I noticed it stopped at 11:30 PM Tuesday.

in the ossec logs there are only notices that it started. What could I enable to get debugging on the script. If I add the --debug $true the script stops with exit code 2.

nbent...@gmail.com

unread,
Sep 20, 2021, 4:23:13 PMSep 20
to Wazuh mailing list
Is there anything I can setup to debug why wodle is not executing the script every hour?

Juan Emiliano Fontana

unread,
Sep 23, 2021, 9:14:54 PMSep 23
to nbent...@gmail.com, Wazuh mailing list

Hi Nbentzinger, hope you are doing great today and thanks for using Wazuh!

You can enable the debug for wazuh-modules in the /var/ossec/etc/internal_options.conf, this file is reserved for debugging issues and for troubleshooting.

You need to edit the file and change the wazuh_modules.debug option from 0 to 2 and then restart the Wazuh Manager. This will add a debug level in the ossec.log file for the specified module. You will find more information about the internal options in here.

Regarding the problem that you are having with the Office 365 script, the problem started after an upgrade of Wazuh? If you restart the Wazuh Manager, the script executes and pull the logs from Office 365? Or you are not getting any log at all?

Let me know.

Regards!

--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/92f09da6-2786-4791-8f05-16371eb34b9fn%40googlegroups.com.

Reply all
Reply to author
Forward
0 new messages