topic Re: Oracle OCI Script Monitor in Cloud Firewall

Oracle OCI Script Monitor

Bernardes — Mon, 02 Oct 2023 17:25:34 GMT

Dear friends,

We have a customer with a CloudGuard cluster in the Oracle OCI environment, which runs a script to validate the Active/Standby members ($FWDIR/scripts/oracle_had.py), and the log output is located in the $FWDIR/log/oracle_had.elg directory.

I would like to know how I could monitor the correct functioning of this script. Is there any Check Point process or tool that could accomplish this? Can cpwatchdog handle this task? If so, what would be the configuration?

Thank you!

Re: Oracle OCI Script Monitor

PhoneBoy — Mon, 02 Oct 2023 17:31:54 GMT

Not aware of any built-in instrumentation to monitor this script.
A script could theoretically be written to monitor the log file and send alerts based on what's there.

Re: Oracle OCI Script Monitor

the_rock — Mon, 02 Oct 2023 18:15:33 GMT

Interesting request...might be worth TAC case.

Re: Oracle OCI Script Monitor

Bernardes — Mon, 02 Oct 2023 22:41:56 GMT

Dear friends @PhoneBoy @the_rock ,

I've been thinking about this specific request, and I believe it could be achieved as follows: The goal is to monitor the output of the log $FWDIR/log/oracle_had.elg, so on the Check Point Gateways, I could create a .sh script with the following content:

###################################################################

#!/bin/bash

while true; do
tail -f /opt/CPsuite-R81.10/fw1/log/oracle_had.elg | nc -l -p 12345
sleep 5
done

###################################################################

and schedule this task in cron. This will make the Gateway create a server listening on port 12345 and sending the content of the specific log.

After that, in some monitoring tool, I can use netcat with the 'nc gateway_ip 12345' command to allow the tool to view the log's output and then create some kind of alert if the log's output contains any unexpected values.

I'm not sure yet which tool could be used or how to configure this alert within it, but this could be a way to go.

Re: Oracle OCI Script Monitor

the_rock — Mon, 02 Oct 2023 23:23:10 GMT

@Bernardes

Yes, that looks good to me. I was thinking of possibly being able to do cron job, sounds like most feasable thing.

Andy