tutorial

Monitoring OSSEC HIDS with Vigilmon

OSSEC is the leading open-source host-based intrusion detection system for log analysis, file integrity monitoring, and rootkit detection. Here's how to monitor OSSEC's manager, web UI, and integrity check schedule with Vigilmon.

OSSEC is the leading open-source host-based intrusion detection system (HIDS) — it performs continuous log analysis, file integrity monitoring (FIM), rootkit detection, and real-time alerting across Linux, Windows, and macOS hosts. When the OSSEC manager goes down, all connected agents go silent: no alerts, no file integrity checks, no rootkit scans. Vigilmon monitors the OSSEC manager process, web UI availability, and integrity check heartbeats so you're alerted the moment your host-based detection capability is compromised.

What You'll Set Up

  • HTTP monitor for the OSSEC web UI (Kibana/AnalogX dashboard)
  • Keyword check for ossec-manager agent connection health
  • Heartbeat monitor for scheduled syscheck (file integrity) runs
  • SSL certificate alerts for the OSSEC web interface

Prerequisites

  • OSSEC manager installed and running (/var/ossec/bin/ossec-control status)
  • At least one OSSEC agent configured and connected
  • Optional: OSSEC web UI deployed (Kibana with OSSEC plugin, or AnalogX)
  • A free Vigilmon account

Step 1: Monitor the OSSEC Web UI

If you use Kibana with the OSSEC integration (via Wazuh/OpenSearch Dashboards) or the standalone AnalogX PHP web UI, monitor the dashboard directly:

  1. Log in to vigilmon.online and click Add Monitor.
  2. Set Type to HTTP / HTTPS.
  3. Enter your OSSEC dashboard URL: https://YOUR_KIBANA_HOST:5601 (Kibana) or http://YOUR_HOST/ossec-ui/ (AnalogX).
  4. Set Check interval to 2 minutes.
  5. Set Expected HTTP status to 200.
  6. Under Advanced, set Expected body contains to a string from the dashboard page (e.g. OSSEC or Kibana).
  7. Click Save.

A 503 or failed keyword check means the dashboard process has crashed or the backing data store (Elasticsearch/OpenSearch) is unreachable — analysts lose visibility into host-based alerts.

Step 2: Expose an OSSEC Manager Health Endpoint

OSSEC has no native HTTP API, so expose a lightweight health check using the ossec-control binary:

# /usr/local/bin/ossec-healthd.py
#!/usr/bin/env python3
from http.server import HTTPServer, BaseHTTPRequestHandler
import subprocess

class Handler(BaseHTTPRequestHandler):
    def do_GET(self):
        try:
            result = subprocess.run(
                ['/var/ossec/bin/ossec-control', 'status'],
                capture_output=True, text=True, timeout=5
            )
            if 'ossec-analysisd is running' in result.stdout:
                self.send_response(200)
                self.end_headers()
                self.wfile.write(b'ossec-manager-ok')
            else:
                self.send_response(503)
                self.end_headers()
                self.wfile.write(b'ossec-manager-error')
        except Exception:
            self.send_response(503)
            self.end_headers()
            self.wfile.write(b'ossec-manager-error')
    def log_message(self, *args):
        pass

HTTPServer(('127.0.0.1', 9292), Handler).serve_forever()

Run as a systemd service, then proxy via your web server with IP allowlisting for Vigilmon's probe addresses.

Step 3: Monitor ossec-manager Process via Keyword Check

Add a Vigilmon monitor pointing at your health endpoint:

  1. Add Monitor → HTTP / HTTPS.
  2. URL: http://YOUR_HOST:9292/ (or the proxied URL).
  3. Set Expected HTTP status to 200.
  4. Under Advanced, set Expected body contains to ossec-manager-ok.
  5. Name it OSSEC manager process.
  6. Set Check interval to 2 minutes.
  7. Click Save.

Extend the health script to also check agent connections:

# Check agent connectivity
agent_result = subprocess.run(
    ['/var/ossec/bin/agent_control', '-l'],
    capture_output=True, text=True, timeout=5
)
if 'Active' in agent_result.stdout:
    self.wfile.write(b'ossec-manager-ok agents-connected')

Add a second Vigilmon monitor with Expected body contains set to agents-connected to verify at least one agent is actively reporting to the manager. A manager with no connected agents may indicate a network segmentation issue or mass agent failure.

Step 4: Heartbeat Monitor for Syscheck Integrity Runs

OSSEC's file integrity monitoring (syscheck) runs on a configurable schedule (default: every 6 hours). If syscheck runs are delayed or skipped, you lose FIM coverage — changes to system binaries, configuration files, and sensitive data go undetected. Monitor the syscheck pipeline with a heartbeat:

# /usr/local/bin/ossec-syscheck-heartbeat.sh
#!/bin/bash
# Check when syscheck last completed by scanning OSSEC alerts
LAST_SYSCHECK=$(grep -l "ossec: File integrity monitoring scan ended" \
  /var/ossec/logs/alerts/alerts.log 2>/dev/null | head -1)

if [ -n "$LAST_SYSCHECK" ]; then
  # Confirm syscheck ran in the last 7 hours
  MODIFIED=$(find /var/ossec/logs/alerts/alerts.log -mmin -420 2>/dev/null)
  if [ -n "$MODIFIED" ]; then
    /usr/bin/curl -fsS "https://vigilmon.online/api/heartbeat/YOUR_SYSCHECK_HEARTBEAT_ID" > /dev/null 2>&1
  fi
fi

Schedule it to run hourly:

# /etc/cron.d/ossec-syscheck-heartbeat
0 * * * * root /usr/local/bin/ossec-syscheck-heartbeat.sh

In Vigilmon:

  1. Add Monitor → Heartbeat.
  2. Name it OSSEC syscheck integrity run.
  3. Set Expected interval to 7 hours (slightly longer than the default 6-hour syscheck interval to allow for natural delay).
  4. Set Grace period to 1 hour.
  5. Paste the heartbeat URL into the script.
  6. Click Save.

If syscheck is disabled, the OSSEC manager is overloaded and falling behind, or the alerts log is not being written, the heartbeat stops and Vigilmon alerts you.

Step 5: OSSEC Daemon Heartbeat via Systemd

For a direct daemon liveness check independent of syscheck scheduling:

# /etc/cron.d/ossec-daemon-heartbeat
* * * * * root /var/ossec/bin/ossec-control status | grep -q "ossec-analysisd is running" && \
  /usr/bin/curl -fsS "https://vigilmon.online/api/heartbeat/YOUR_DAEMON_HEARTBEAT_ID" > /dev/null 2>&1

In Vigilmon:

  1. Add Monitor → Heartbeat.
  2. Name it OSSEC daemon heartbeat.
  3. Set Expected interval to 2 minutes.
  4. Set Grace period to 3 minutes.
  5. Paste the heartbeat URL into the cron command.
  6. Click Save.

This catches a crashed ossec-analysisd process immediately — within 3 minutes of the daemon stopping, you receive an alert.

Step 6: SSL Certificate Alerts for the OSSEC Web Interface

If your OSSEC Kibana dashboard or AnalogX UI is served over HTTPS, monitor the certificate to ensure analysts always have secure, uninterrupted access:

  1. Open the HTTP/HTTPS monitor for your OSSEC web UI (created in Step 1).
  2. Enable Monitor SSL certificate in the SSL section.
  3. Set Alert when certificate expires in less than 14 days.
  4. Click Save.

An expired certificate on the OSSEC dashboard is particularly dangerous: during an active incident, security analysts may be locked out of the very interface they need to triage the alert. The 14-day window gives you ample time to renew before expiry.

Summary

| Monitor | Target | What It Catches | |---|---|---| | Web UI HTTP | Kibana / AnalogX | Dashboard crash, data store failure | | Manager health | :9292/ keyword | ossec-analysisd crash | | Agent connection | :9292/ keyword | All agents disconnected | | Syscheck heartbeat | hourly cron | FIM scan delayed or disabled | | Daemon heartbeat | cron + ossec-control | Manager process crash | | SSL certificate | OSSEC web interface | Certificate expiry |

OSSEC's host-based detection is the last line of defense against threats that bypass perimeter security. A crashed manager, stalled syscheck, or disconnected agent creates blind spots that attackers exploit. Vigilmon's layered monitoring — from process checks to heartbeat-based FIM verification — ensures your HIDS never silently goes dark.

Monitor your app with Vigilmon

Free plan — 5 monitors, no credit card required. Up and running in 60 seconds.

Start free →
← Back to all articles