Skip to content

Instantly share code, notes, and snippets.

What would you like to do?
basic ossec broker client
### example is taken and modified from python doc website from socketserver
# to run the example: $ python
import threading
import socket
import SocketServer
import multiprocessing
# This class handles UDP requests that come in on the server. Here we do the main work
# of the program, that is, we check if the OSSEC server is alive and processing logs
# Each thread sends a TCP request to the OSSEC BROKER SERVER, and if it gets a reply,
# forwards the original UDP packet from the OSSEC agent to the OSSEC server
# If it fails, i.e. gets no answer, then it places the data into a queue for later replay
# If it succeeds, i.e. it gets an answer from the OSSEC BROKER SERVER, it sends the packet onwards,
# and then waits for 5 seconds for a potential reply from the server. If it gets a reply, this is
# forwarded back to the agent. Otherwise the thread is killed off to prevent leakage
class ThreadedUDPRequestHandler(
def handle(self):
# queue is defined as global so that it is accessbile across all threads
global queue
# get sent data, and remove extra spaces
data = self.request[0].strip()
# get port number
port = self.client_address[1]
# get the communicate socket
client_socket = self.request[1]
### get client host ip address
client_address = (self.client_address[0])
### proof of multithread - more for debug than anything else
cur_thread = threading.current_thread()
print "thread %s"
print "received call from client address :%s" %client_address
print "received data from port [%s]: %s" %(port,data)
# try to connect to OSSEC BROKER SERVER
broker_server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
## note the hardcoded IP address, this should be changed
broker_server.connect(("", 1514))
print "sending PING to broker ???"
# send a ping to the broker server
# get the response
broker_response = broker_server.recv(1024)
# if the broker server connection fails, put the original OSSEC agent packet into
# an in-memory queue, and exit
print "did not get PONG from server ---- "
# assuming we got a response, we check if all is ok
# if all is ok, the server will respond with "pong"
if broker_response == "pong":
# if the server responded, we first check if there are packets in the queue waiting to be sent
# if there are, we send them out to the OSSEC server over UDP
while not queue.empty():
# we have messages to replay
replay_data = queue.get()
print "replaying data on to server ------------>"
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
s.sendto(replay_data, ('',1514))
print "got PONG from broker ***"
# once the queue has been emptied, we continue on to send
# the original packet to the OSSEC server
print "sending data on to server ------------>"
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
# OSSEC agent doesnt always expect an answer back from the server, so we set a very short timeout
# this may need to be tuned if used over a noisy or high latnecy network link
s.sendto(data, ('',1514))
### assemble a response message to client
data, addr = s.recvfrom(32768)
print "sending data on to client <------------"
client_socket.sendto(data, self.client_address)
# if socket timeout, it means that the agent sent a packet which did not require a response, move along
except socket.timeout:
print "timeout....moving on"
# if the server doesn't send "PONG", it means the server is rechable but ossec remoted is down, so again place the
# packet into a queue
print "did not get PONG from server ---- "
# place into queue for later replay
class ThreadedUDPServer(
if __name__ == "__main__":
# first setup the info for the connections to be made: host and port
# these should always be localhost and 1514 respectively
HOST, PORT = "localhost", 1514
global queue
queue = multiprocessing.Queue()
# second, startup the Threaded UDP Server on above defined host and port
# and define that ThreadedUDPRequestHandler will handle requests
server = ThreadedUDPServer((HOST, PORT),
# serve forever - as in keep on serving requests, do not kill off after one
# Start a thread with the server --
# that thread will then start one
# more thread for each request
server_thread = threading.Thread(target=server.serve_forever)
# Exit the server thread when the main thread terminates
server_thread.daemon = True
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment