一条命令诊断OSSIM系统

alienvault-doctor是一个非常实用的OSSIM系统检测脚本，下面看看对一个故障系统的检测效果：

VirtualUSMAllInOne:~# alienvault-doctor 

AlienVault Doctor version 4.13.0 (Hemingway)

     AlienVault version:                                     4.13.0

     Installed profiles:           Server,Database,Framework,Sensor

     Operating system:                                        Linux

     Hardware platform:                                      x86_64

     Hostname:                                   VirtualUSMAllInOne

Hmmm, let the Doctor have a look at you...

[Warning] Could not evaluate " "Can't retrieve sensor list: Error while querying for 'Sensor' systems: (OperationalError) (2003, "Can't connect to MySQL server on '127.0.0.1' (111)") None None" ==""" in check "Celery workers": invalid syntax (<string>, line 1)

...

Hooray! The Doctor has diagnosed you, check out the results...

     Plugin ansiblemgr_log.plg didn't run: Cannot parse file "/var/log/alienvault/api/ansiblemgr.log": [Errno 2] No such file or directory: '/var/log/alienvault/api/ansiblemgr.log'

     Plugin: connection_no

          [*] Connections: Number of connections between server, mysql and/or IDM not expected

              Word of advice: Connections to the AlienVault subsystems vary between a well defined range. Please check where the extra connections come from

     Plugin: disk_usage

          [*] root partition critical: All good

          [*] root partition warning: All good

     Plugin mysql_history didn't run: Cannot parse file "/root/.mysql_history": [Errno 2] No such file or directory: '/root/.mysql_history'

     Plugin: netstat

          [*] RX and TX queues: ossim server, agent or mysql may have problems with their rx/tx queues

              Word of advice: RX/TX queues are network buffers. Large queues may point to network problems. Please check your network connection and hardware

     Plugin gunicorn_access_log didn't run: Cannot parse file "/var/log/alienvault/api/gunicorn_access.log": [Errno 2] No such file or directory: '/var/log/alienvault/api/gunicorn_access.log'

     Plugin: corrupt_tables

          [*] Corrupted tables: All good

     Plugin: installed_pkg

          [*] Default packages: Some packages do not match default installation

              Word of advice: AlienVault systems are designed to work with a well defined set of packages. Adding or deleting packages manually is not supported and may lead to unexpected results

          [*] Version compliance: Some package versions do not match with the installed AlienVault version

              Word of advice: AlienVault packages are built and tested to work in a version consistent fashion. Inconsistent versions across different AlienVault packages could lead to unexpected issues.

     Plugin superdoctor didn't run: Required file "/usr/sbin/sdt" does not exist

     Plugin: percona_logrotate

          [*] signatures: All good

          [*] mysql.err: mysql.err is not on the logrotate configuration

              Word of advice: The mysql.err file may become too large and should be rotated properly. Please check your logrotate configuration

          [*] mysql.log: All good

     Plugin: celerybeat_log.plg

          [*] Celerybeat process: All good

     Plugin gunicorn_log didn't run: Cannot parse file "/var/log/alienvault/api/gunicorn.log": [Errno 2] No such file or directory: '/var/log/alienvault/api/gunicorn.log'

     Plugin chassis didn't run: Required module "ipmi_devintf" is not present

     Plugin: celeryworker_log.plg

          [*] Celery workers: Celery is not working properly

              Word of advice: Celery is the task manager of choice in AlienVault. Workers reporting errors may suggest that your queues or custom tasks are not working properly.

     Plugin: processes

          [*] Server: All good

          [*] Indexer: All good

          [*] MySQL: All good

     Plugin: api_log

          [*] Number of connection attempts to RabbitMQ: All good

     Plugin bash_history didn't run: Cannot parse file "/root/.bash_history": [Errno 2] No such file or directory: '/root/.bash_history'

     Plugin: pkg_checksum

          [*] ossim_checks: All good

     Plugin: server_log

          [*] IDM connection recovery: All good

          [*] Remote server connection recovery: All good

     Plugin: network_interface

          [*] Collisions: All good

          [*] RX/TX errors: All good

          [*] MTU: All good

     Plugin: default_hw

          [*] Default hardware: All good

     Plugin: schema_version

          [*] Schema version: All good

     Plugin: null_fields

          [*] Event sensor field: Some events in your database have null sensor_id fields

              Word of advice: Events without an associated sensor_id are a sign of misconfigured plugins and/or sensor properties. Please check both in your system

          [*] Server DB configuration: All good

     Plugin vm_requirements didn't run: Memory requirement is not met

接下来我们根据这些标红的提示来有针对性的进行故障处理。

下面还是要了解正常系统的检测数据：

# alienvault-doctor 

AlienVault Doctor version 5.1.1 (Mewes)

     AlienVault version:                                                    5.1.1-TRIAL

     License:                                                                      None

     Licensed Assets:                                                         UNLIMITED

     Software profile:                              Server, Database, Framework, Sensor

     Hardware profile:                                      alienvault-vmware-aio-6x1gb

     Last updated:                                         Mon Sep 07 11:35:35 2015 EST

Hmmm, let the Doctor have a look at you

[Warning] 

Check 00560002 is not meant to be run in alienvault-vmware-aio-6x1gb

[Warning] 

Check 00030002 is not meant to be run in alienvault-vmware-aio-6x1gb

[Warning] 

Check 00210009 is not meant to be run in alienvault-vmware-aio-6x1gb

[Warning] 

Check 00210008 is not meant to be run in alienvault-vmware-aio-6x1gb

[Warning] 

Check 00210007 is not meant to be run in alienvault-vmware-aio-6x1gb

[Warning] 

Check 00210006 is not meant to be run in alienvault-vmware-aio-6x1gb

[Warning] 

Check 00210005 is not meant to be run in alienvault-vmware-aio-6x1gb

[Warning] 

Check 00260001 is not meant to be run in a TRIAL license

...

Hooray! The Doctor has diagnosed you, check out the results...

  Be careful! Seems that you are not in the Strike Zone! Please check the output below.

     Plugin: 0001 Agent Cache Disk

             Check the disk space used by the AlienVault Agent cache

         [*] 00010001: All good

     Plugin: 0002 Agent Cache Files

             Checks the integrity of the AlienVault Agent cache

         [*] 00020001: All good

     Plugin: 0003 AlienVault Agent log

             Parses the Agent log to search for errors.

         [*] 00030003: All good

         [*] 00030001: All good

     Plugin: 0004 Enabled Agent Plugins

             Check the number of AlienVault plugins enabled in the Agent

         [*] 00040001: All good

         [*] 00040002: All good

     Plugin: 0005 Agent Plugins

             Looks for the plugin files enabled, and then checks its existance

             In the Strike Zone?: True

         [*] 00050001: All good

     Plugin: 0006 Agent plugins integrity

             Verifies the integrity of the default Agent plugins.

             In the Strike Zone?: True

         [*] 00060002: All good

         [*] 00060001: All good

     Plugin: 0007 Agent Plugins

             Check the integrity of the agent plugins configuration

         [*] 00070001: All good

     Plugin: 0008 Agent rsyslog configuration files integrity

             Check the integrity of the default Agent rsyslog configuration files.

             In the Strike Zone?: True

         [*] 00080001: All good

         [*] 00080002: All good

     Plugin: 0009 Dummy packages

             Check the dummy packages

             In the Strike Zone?: True

         [*] 00090001: All good

     Plugin: 0010 AlienVault API log

             Parses the API log to search for issues.

         [*] 00100002: All good

         [*] 00100001: All good

     Plugin: 0011 Backup Manager errors in frameworkd_error.log

             Parses the frameworkd error log searching for Backup Manager errors

         [*] 00110001: All good

     Plugin: 0012 Backup notifications log

             Parses the api backup notifications log to search for issues.

         [*] 00120001: All good

     Plugin: 0013 Bash history

             Searches for anomalies in the root .bash_history file.

             In the Strike Zone?: True

         [*] 00130001: All good

         [*] 00130002: All good

         [*] 00130003: All good

         [*] 00130004: All good

         [*] 00130005: All good

         [*] 00130006: All good

         [*] 00130007: All good

     Plugin: 0014 Celerybeat log

             Parses the celerybeat.log file, searching for errors.

         [*] 00140001: All good

     Plugin: 0015 Celery worker log

             Parses the Celery w1.log file for errors.

         [*] 00150001: All good

     Plugin: 0016 Appliance chassis

         [*] 00160001: All good

     Plugin: 0017 Connection number

             Checks the number of connections from/to this computer.

         [*] 00170001: All good

     Plugin: 0018 Current network configuration

             Monitors the network configuration searching for network problems.

             In the Strike Zone?: False

         [*] 00180003: All good

         [*] 00180002: Configured and running network interfaces do not match

             Word of advice: The number of configured network interfaces and running network interfaces do not match. Please check the network configuration to adjust the running interfaces

         [*] 00180001: All good

         [*] 00180005: All good

         [*] 00180004: All good

     Plugin: 0019 Licensed Devices

             Compares the number of current devices registered against the number of licensed devices

             In the Strike Zone?: True

         [*] 00190001: All good

     Plugin: 0020 Database migration log

             Parses the database_migration.log file, searching for errors.

         [*] 00200001: All good

     Plugin: 0021 AlienVault appliance processes

             Check for misbehaviour of running/not running processes in each of the AlienVault appliances.

         [*] 00210004: All good

         [*] 00210003: All good

         [*] 00210002: All good

         [*] 00210001: All good

     Plugin: 0022 DB data consistency

             Checks the data consistency in the AlienVault database.

             In the Strike Zone?: False

         [*] 00220019: All good

         [*] 00220018: All good

         [*] 00220017: All good

         [*] 00220016: All good

         [*] 00220015: All good

         [*] 00220014: All good

         [*] 00220013: All good

         [*] 00220012: All good

         [*] 00220011: All good

         [*] 00220010: All good

         [*] 00220022: All good

         [*] 00220023: All good

         [*] 00220020: All good

         [*] 00220021: All good

         [*] 00220008: All good

         [*] 00220009: All good

         [*] 00220004: Current event window is bigger than the backup one

             Word of advice: A malfunctioning backup system may lead to a general failure. Please check the AlienVault backup configuration

         [*] 00220005: All good

         [*] 00220006: All good

         [*] 00220007: All good

         [*] 00220001: All good

         [*] 00220002: All good

     Plugin: 0023 Database status

             Tests database health, searching for crashed processes or inefficient queries, among other issues.

         [*] 00230005: All good

         [*] 00230004: All good

         [*] 00230001: All good

         [*] 00230003: All good

         [*] 00230002: All good

     Plugin: 0024 Default mounted file systems

             Checks the mounted file systems.

         [*] 00240001: All good

     Plugin: 0025 Default hardware

             Checks the standard hardware.

             In the Strike Zone?: True

         [*] 00250001: All good

     Plugin: 0026 Default repositories

             Searches for the default repositories

             In the Strike Zone?: True

         [*] 00260002: All good

         [*] 00260003: All good

         [*] 00260004: All good

     Plugin: 0027 Default server packages

             Searches for the default packages in a Server profile.

             In the Strike Zone?: False

         [*] 00270001: Some packages do not match with the AlienVault default installation

             Word of advice: AlienVault systems are designed to work with a well defined set of packages. Adding or deleting packages manually is not supported and may lead to unexpected results

         [*] 00270003: All good

         [*] 00270002: All good

         [*] 00270004: All good

     Plugin: 0028 Detailed network link status

             Uses ethtool to check the network link status

         [*] 00280001: All good

     Plugin: 0029 Disk size

             Checks the disk size

             In the Strike Zone?: True

         [*] 00290001: All good

     Plugin: 0030 Disk usage

             Checks the disk usage in AlienVault important partitions.

         [*] 00300001: All good

         [*] 00300002: All good

     Plugin: 0031 Hosts configuration file

             Parses the /etc/hosts file for inconsistencies

             In the Strike Zone?: True

         [*] 00310001: All good

         [*] 00310002: All good

         [*] 00310003: All good

     Plugin: 0032 IO speed

             Detects low IO speed.

         [*] 00320001: All good

     Plugin: 0033 Kernel configuration

             Detects Kernel configuration changes.

             In the Strike Zone?: True

         [*] 00330001: All good

     Plugin: 0034 MySQL history

             Searches for anomalies in the root .mysql_history file.

             In the Strike Zone?: True

         [*] 00340001: All good

         [*] 00340002: All good

     Plugin: 0035 Network link status

             Uses mii-tool to check the network link status

             In the Strike Zone?: True

         [*] 00350001: All good

         [*] 00350002: All good

     Plugin: 0036 Network services

             Detects common network service related problems.

         [*] 00360002: All good

         [*] 00360001: All good

     Plugin: 0037 Network routing

             Parses the /etc/resolv.conf file for inconsistencies

             In the Strike Zone?: True

         [*] 00370001: All good

     Plugin: 0041 Package checksum

             Searches for modified files that originally belonged to a package.

             In the Strike Zone?: True

         [*] 00410001: All good

     Plugin: 0042 Reachable systems

             Checks for reachable systems using the API

         [*] 00420001: All good

     Plugin: 0043 Redis Health Status

             Checks Health Status by pinging through redis-cli

         [*] 00430001: All good

     Plugin: 0044 Redis dump.rdb size

             Checking Redis Health Status by computing /var/lib/redis/dump.rdb size

         [*] 00440001: All good

     Plugin: 0045 Domain nameservers configuration file

             Parses the /etc/resolv.conf file to search for inconsistencies

             In the Strike Zone?: True

         [*] 00450001: All good

         [*] 00450002: All good

     Plugin: 0046 Backup restore process log

             Parses the restore process log searching for potential issues.

         [*] 00460002: All good

         [*] 00460003: All good

         [*] 00460001: All good

         [*] 00460006: All good

         [*] 00460007: All good

         [*] 00460004: All good

         [*] 00460014: All good

         [*] 00460008: All good

         [*] 00460005: All good

         [*] 00460015: All good

         [*] 00460013: All good

         [*] 00460009: All good

         [*] 00460011: All good

         [*] 00460010: All good

         [*] 00460012: All good

     Plugin: 0047 Database schema version

             Looks for compatibility problems between the DB schema deployed and the packages installed.

             In the Strike Zone?: True

         [*] 00470001: All good

     Plugin: 0048 AlienVault Server profile connections

             Analyzes the connections established to the AV Server

         [*] 00480001: All good

         [*] 00480002: Missing connections to the AV Forward

             Word of advice: Some expected network connections to the AV Forward are not present. Please check your configuration and/or network status.

     Plugin: 0049 Server log files

             Searches for Server issues parsing its log file.

         [*] 00490001: All good

         [*] 00490002: All good

     Plugin: 0051 Server statistics

             Checks the server status by parsing statistics

         [*] 00510004: All good

         [*] 00510002: All good

         [*] 00510003: All good

         [*] 00510001: All good

     Plugin: 0053 Supermicro SuperDoctor

         [*] 00530004: All good

         [*] 00530005: All good

         [*] 00530006: All good

         [*] 00530001: All good

         [*] 00530002: All good

         [*] 00530003: All good

     Plugin: 0054 Unsupported Installations

             Searches for unsupported installations

             In the Strike Zone?: True

         [*] 00540001: All good

     Plugin: 0055 AlienVault Update log

             Parses the Update log to search for errors.

         [*] 00550001: All good

     Plugin: 0056 VM requirements

             Analyzes the deployment details in a virtual environment extracting the detailed information on the hardware configuration of the machine.

             In the Strike Zone?: True

         [*] 00560001: All good