Skip to content

Instantly share code, notes, and snippets.

@reyjrar

reyjrar/crontab.xml

Created June 26, 2013 15:46
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save reyjrar/5868559 to your computer and use it in GitHub Desktop.
Save reyjrar/5868559 to your computer and use it in GitHub Desktop.
Download ZIP
OSSEC Decoder for crontab manipulation.
Raw
crontab.xml
<!-- Decoder to enable extracting data from the crontab command
Aug 30 17:13:02 server.example.com crontab[1347]: (root) LIST (root)
Aug 30 17:13:38 server.example.com crontab[2852]: (root) BEGIN EDIT (root)
Aug 30 17:13:41 server.example.com crontab[2852]: (root) REPLACE (root)
Aug 30 17:13:41 server.example.com crontab[2852]: (root) END EDIT (root)
Aug 30 17:14:01 server.example.com crond[1756]: (root) RELOAD (/var/spool/cron/root)
Aug 30 17:14:01 server.example.com CROND[4018]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Aug 30 17:14:06 server.example.com crontab[4030]: (root) LIST (root)
Aug 30 17:15:01 server.example.com CROND[5818]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Aug 30 17:16:01 server.example.com CROND[6515]: (root) CMD (/usr/lib64/sa/sa1 1 1)
-->
<decoder name="crontab">
<program_name>crontab</program_name>
</decoder>
<decoder name="crontab-user">
<parent>crontab</parent>
<regex>^\((\S+)\) </regex>
<order>user</order>
</decoder>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment