wazuh-monitord agent连接监控

ossecc -monitord程序监视agent的连接。此外，它每天或当内部日志达到一定的可配置大小时对其进行旋转和压缩。

1.掉线时间间隔配置

agent掉线时间间隔

        <agents_disconnection_time>1m</agents_disconnection_time>       
agent掉线告警时间间隔

        <agents_disconnection_alert_time>1h</agents_disconnection_alert_time>

2.监控agent连接

连接到消息队列

    /* Connect to the message queue
     * Exit if it fails.
     */
    if ((logr.m_queue = StartMQ(DEFAULTQUEUE, WRITE, INFINITE_OPENQ_ATTEMPTS)) < 0) {
        merror_exit(QUEUE_FATAL, DEFAULTQUEUE);
    }

这个是通用消息队列，一般消息都走这个消息队列 

/* Default queue */
#define DEFAULTQUEUE    "queue/sockets/queue"

 监控连接状态函数

void monitor_agents_alert(){
    unsigned int inode_it = 0;
    OSHashNode *agent_hash_node = NULL;
    OSHashNode *agent_hash_next_node = NULL;

    cJSON *j_agent_info = NULL;
    cJSON *j_agent_status = NULL;
    cJSON *j_agent_lastkeepalive = NULL;
    cJSON *j_agent_name = NULL;
    cJSON *j_agent_ip = NULL;

    agent_hash_node = OSHash_Begin(agents_to_alert_hash, &inode_it);
    while (agent_hash_node) {
        agent_hash_next_node = OSHash_Next(agents_to_alert_hash, &inode_it, agent_hash_node);

        j_agent_info = wdb_get_agent_info(atoi(agent_hash_node->key), &sock);
        if (j_agent_info) {
            j_agent_status = cJSON_GetObjectItem(j_agent_info->child, "connection_status");
            j_agent_lastkeepalive = cJSON_GetObjectItem(j_agent_info->child, "last_keepalive");
            j_agent_name = cJSON_GetObjectItem(j_agent_info->child, "name");
            j_agent_ip = cJSON_GetObjectItem(j_agent_info->child, "register_ip");

            if (cJSON_IsString(j_agent_status) && j_agent_status->valuestring != NULL &&
                cJSON_IsString(j_agent_name) && j_agent_name->valuestring != NULL &&
                cJSON_IsString(j_agent_ip) && j_agent_ip->valuestring != NULL &&
                cJSON_IsNumber(j_agent_lastkeepalive)) {

                    if (strcmp(j_agent_status->valuestring, "active") == 0) {
                        /* The agent is now connected, removing from table */
                        OSHash_Delete(agents_to_alert_hash, agent_hash_node->key);
                    }

                    else if (j_agent_lastkeepalive->valueint < (time(0) -
                            (mond.global.agents_disconnection_time + mond.global.agents_disconnection_alert_time))) {
                        /* Generating the disconnection alert */
                        char *agent_name_ip = NULL;
                        os_strdup(j_agent_name->valuestring, agent_name_ip);
                        wm_strcat(&agent_name_ip, j_agent_ip->valuestring, '-');
                        monitor_send_disconnection_msg(agent_name_ip);
                        OSHash_Delete(agents_to_alert_hash, agent_hash_node->key);
                        os_free(agent_name_ip);
                    }
                }
        } else {
            mdebug1("Unable to retrieve agent's '%s' data from Wazuh DB", agent_hash_node->key);
            OSHash_Delete(agents_to_alert_hash, agent_hash_node->key);
        }
        cJSON_Delete(j_agent_info);
        agent_hash_node = agent_hash_next_node;
    }
}

掉线超时判断else if ( j_agent_lastkeepalive->valueint < (time(0) - (mond.global.agents_disconnection_time + mond.global.agents_disconnection_alert_time)) )

                    if (strcmp(j_agent_status->valuestring, "active") == 0) {
                        /* The agent is now connected, removing from table */
                        OSHash_Delete(agents_to_alert_hash, agent_hash_node->key);
                    }

                    else if (j_agent_lastkeepalive->valueint < (time(0) -
                            (mond.global.agents_disconnection_time + mond.global.agents_disconnection_alert_time))) {
                        /* Generating the disconnection alert */
                        char *agent_name_ip = NULL;
                        os_strdup(j_agent_name->valuestring, agent_name_ip);
                        wm_strcat(&agent_name_ip, j_agent_ip->valuestring, '-');
                        monitor_send_disconnection_msg(agent_name_ip);
                        OSHash_Delete(agents_to_alert_hash, agent_hash_node->key);
                        os_free(agent_name_ip);
                    }

 发送掉线消息

void monitor_send_disconnection_msg(char *agent) {
    char str[OS_SIZE_1024];
    int error;

    memset(str, '\0', OS_SIZE_1024);
    /* Send disconnected message */
    snprintf(str, OS_SIZE_1024, AG_DISCON_MSG, agent);
    if (error = mon_send_agent_msg(agent, str), error) {
        if (error == 2) {
            // Agent is no longer in the database
            monitor_send_deletion_msg(agent);
        } else {
            mdebug1("Could not generate disconnected agent alert for '%s'", agent);
        }
    }
}

如果 mon_send_agent_msg函数返回2，说明Wazuh DB中没有找到agent_id（具体是通过agent_name找agent_id）

int mon_send_agent_msg(char *agent, char *msg) {
    char header[OS_SIZE_256];
    char ag_name[OS_SIZE_128];
    int ag_id;
    char *ag_ip = NULL;
    char *found = agent;
    size_t name_size;

    while (found = strchr(found, '-'), found) {
        ag_ip = ++found;
    }

    if (!ag_ip) {
        return 1;
    }

    if (name_size = strlen(agent) - strlen(ag_ip), name_size > OS_SIZE_128) {
        return 1;
    }

    snprintf(ag_name, name_size, "%s", agent);

    if (ag_id = wdb_find_agent(ag_name, ag_ip, NULL), ag_id > 0) {

        snprintf(header, OS_SIZE_256, "[%03d] (%s) %s", ag_id, ag_name, ag_ip);
        if (SendMSG(mond.a_queue, msg, header, SECURE_MQ) < 0) {
            mond.a_queue = -1;  // set an invalid fd so we can attempt to reconnect later on.
            merror(QUEUE_SEND);
            return 1;
        }
        return 0;
    } else if (ag_id == -2) {
        return 2;
    }

    return 1;
}

 将消息通过消息队列发出去

SendMSG(mond.a_queue, msg, header, SECURE_MQ)

/* Send a message to the queue */
int SendMSG(int queue, const char *message, const char *locmsg, char loc)
{
    int __mq_rcode;
    char tmpstr[OS_MAXSTR + 1];
    static int reported = 0;

    tmpstr[OS_MAXSTR] = '\0';

    /* Check for global locks */
    os_wait();

    if (loc == SECURE_MQ) {
        loc = message[0];
        message++;

        if (message[0] != ':') {
            merror(FORMAT_ERROR);
            return (0);
        }
        message++; /* Pointing now to the location */

        if (strncmp(message, "keepalive", 9) == 0) {
            return (0);
        }

        snprintf(tmpstr, OS_MAXSTR, "%c:%s->%s", loc, locmsg, message);
    } else {
        snprintf(tmpstr, OS_MAXSTR, "%c:%s:%s", loc, locmsg, message);
    }

    /* Queue not available */
    if (queue < 0) {
        return (-1);
    }

    if ((__mq_rcode = OS_SendUnix(queue, tmpstr, 0)) < 0) {
        /* Error on the socket */
        if (__mq_rcode == OS_SOCKTERR) {
            merror("socketerr (not available).");
            close(queue);
            return (-1);
        }

        /* Unable to send. Socket busy */
        mdebug2("Socket busy, discarding message.");

        if (!reported) {
            reported = 1;
            mwarn("Socket busy, discarding message.");
        }
    }

    return (0);
}

/* Send a message using a Unix socket
 * Returns the OS_SOCKETERR if it fails
 */
int OS_SendUnix(int socket, const char *msg, int size)
{
    if (size == 0) {
        size = strlen(msg) + 1;
    }

    if (send(socket, msg, size, 0) < size) {
        if (errno == ENOBUFS) {
            return (OS_SOCKBUSY);
        }

        return (OS_SOCKTERR);
    }

    return (OS_SUCCESS);
}

 mond.a_queue 是socket对应的fd

通过SendMSG函数可知：

• 如果消息中包含"keepalive"字符串，那么消息不会发送。
• 消息发出去的结构是 SECURE_MQ：header：msg这三部以冒号分隔，然后通过OS_SendUnix发送到消息队列
• mond.a_queue 指向的DEFAULTQUEUE

3.ossec-analysisd 进程接收

设置消息队列

        /* Set the queue */
        if ((m_queue = StartMQ(DEFAULTQUEUE, READ, 0)) < 0) {
            merror_exit(QUEUE_ERROR, DEFAULTQUEUE, strerror(errno));
        }

 接收处理消息队列中的消息

    /* Create message handler thread */

    w_create_thread(ad_input_main, &m_queue);

 消息接收函数

/* Receive a message from a Unix socket */
int OS_RecvUnix(int socket, int sizet, char *ret)
{
    struct sockaddr_un n_us;
    socklen_t us_l = sizeof(n_us);
    ssize_t recvd;
    ret[sizet] = '\0';

    if ((recvd = recvfrom(socket, ret, sizet - 1, 0,
                          (struct sockaddr *)&n_us, &us_l)) < 0) {
        return (0);
    }

    ret[recvd] = '\0';
    return ((int)recvd);
}

参考

global - Local configuration (ossec.conf) · Wazuh documentation

ossec-monitord - Daemons · Wazuh documentation