Execute Command Alarm Callback - Echo Command

Graylog Central (peer support)
1

Hello, everyone,

For sending the notification to the Google-Chat channel I am using Execute Command Alarm Callback Everything working fine, I am receiving alerts whenever any alert triggers. But in the same script, I added an echo command that will print the alert triggered time and date along with the variables data and append this into another directory CSV file. The problem is echo command is not working/responding. When I execute the same script directly on the server it’s working fine.

I tried everything but still, the echo command is not working. Don’t know is this a Graylog problem or something else. Could anyone help me with this? Sorry for the silly question.

I need to maintain a sheet that will contain Graylog triggered alerts.

Thanks
Tafsir

Screen Shot 2020-11-06 at 12.59.57 AM
Screen Shot 2020-11-06 at 12.59.57 AM1250×639 86.9 KB

2

he @Tafsir_Alam

when you call that script manually - is that echo working? Is that running if you do it as Graylog user?

3

Hi, @jan Thanks for the quick response.
Yes, the echo is working when I call the script manually. I am running the script as a root user.

4

you should run the script as Graylog user - as this is the context Graylog is calling that.

5

Ran the script as Graylog user but still it’s not working.

6

so the work is now that you make that work as Graylog user.

Check the path, check that Graylog can run the command.

This is basic sys-admin work to figure out how to run the command within the script.

7

Hi @jan
I am able to run the same script manually on the server. I have already changed the ownership of the directory and file as Graylog user and group but still, it’s not working. The script is working fine till the curl command but after that not able to execute any Linux command.

Is there anything to do with the Execute Command Alarm Callback plugin?

8

he @Tafsir_Alam

you wrote that the script does not give the desired output when you run this as Graylog user. If that isn’t the case you need to fix that first.

9

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.