Automate DVD Ripping for Mac

I like to rip my DVD’s and put them in iTunes to sync with my phone or iPad. I’m sure I’m not alone and over time I’ve slowly added movies here and there as needed. You know the process rip the dvd, encode, add to iTunes, add the images, blah, blah. Its a long process if you do it right. So while searching for a better way to rip some of my TV show DVDs, I came across the best tutorial I’ve ever seen. Its all wrapped up in automater and I can’t save thank enough for how much time I think this will save me in the future. So if you been looking like I have check out: How-To: Automate DVD & Blu-Ray (Backup, Encoding & Tagging) for Mac OS X 10.6

Status Messages in screen

In the February 2011 issue of Linux Journal Kyle Rankin wrote an article called Status Messages in Screen. I’ve been using screen for years but never thought much about what it could do beside keep my shell open on a remote server. Well this article opened my eyes. I quickly dug in and start working on my .screenrc on my macbook. I was able to write a couple of applescripts to pull inbox counts from entourage and Cool stuff i look forward to seeing what other useful info I can get in there since i do like to work at the cli a lot. Thanks Kyle.

Checking the snort process from nagios

I’m checking the snort basically like i’m checking most processes, if you’ve been following allong then you’ll already have a check_procs setup.

So I simply edit my localhost.cfg and add:
define service{
use generic-service
host_name localhost
service_description Snort
check_command check_snort_procs!1:1!snort

Edit the commands.cfg and add:
define command{
command_name check_snort_procs
command_line $USER1$/check_procs -c $ARG1$ -C $ARG2$

reload nagios and thats it.

My BASE (for Snort) Install Notes for OSX

To get base up and going with snort already installed I did the following.
1. Downlaod ADOdb (database abstraction library for PHP) :
The version I got was adodb510.tgz

2. Unzip and untar the file
tar -xvzf adodb510.tgz

3. Move the folder
I did:
cp -R adodb5/ /Library/WebServer/Documents/adodb5/

4. Download base: The version I got was: base-1.4.4.tar.gz

5. Unzip and tar the file
tar -xvzf base-1.4.4.tar.gz

6. You should now have a folder: base-1.4.4/
cd base-1.4.4/

7. Copy the base folder to your webserver folder
cp base-1.4.4/ /Library/WebServer/Documents/base/
change the owner on the folder
sudo chown -R _www:_www /Library/WebServer/Documents/base/
With this version there was a known problem with the file: on some setups, mine included.
So I had to download the fixed version from CVS
You can also download it from the website, follow the link from here:
it goes in your /base/templates/

8. Now install the needed pear extensions for graphs to work in base
On my system it was as follows:
First I had to update pear to the rest of the packages would work:
sudo /usr/local/php5/bin/pear install PEAR-1.9.0

Then the following packages:
sudo /usr/local/php5/bin/pear install Image_Color
sudo /usr/local/php5/bin/pear install Image_Canvas-0.3.2
sudo /usr/local/php5/bin/pear install Image_Graph-0.7.2

9. Open up base in your browser:
You should get the page up with the settings, if you have any errors you need to fix them first with their suggestions.
Once you answer all the setup questions you should have a working base install.

My Snort on OSX Install Notes

1 Download Snort2 Download pcre
3 Untar pcre
4 Cd to pcre
5 ./configure
make install
(NOTE: Install prefix ……………… : /usr/local)
6 Untar Snort
7 CD to snort
8 ./configure -enable-dynamicplugin –with-mysql –with-mysql-includes=/opt/local/include/mysql5/ –with-mysql-libraries=/opt/local/lib/mysql5/mysql/
9 make
10 sudo make install
/usr/bin/install -c -m 644 ‘./snort.8’ ‘/usr/local/man/man8/snort.8’
test -z “/usr/local/lib/pkgconfig” || /bin/sh ./mkinstalldirs “/usr/local/lib/pkgconfig”
/usr/bin/install -c -m 644 ‘snort.pc’ ‘/usr/local/lib/pkgconfig/snort.pc’

11. Get the rules from the snort site and untar them
I used snorttemp as the folder
12. Make a folder for the rules
mkdir /opt/local/etc/snort/
mkdir /opt/local/etc/snort/rules/
13. Copy the rules over
cd ~/snorttemp/rules/
cp * /opt/local/etc/snort/rules/
I also copied over the etc folder
cd ~/snorttemp/etc/
cp * /opt/local/etc/snort/
14. Edit the Snort configuration
vi /opt/local/etc/snort/snort.cfg
change “var HOME_NET any” to “var HOME_NET” or whatever your home network is
change “var EXTERNAL_NET any” to “var EXTERNAL_NET !$HOME_NET” This is everything except your home network
change “var RULE_PATH ../rules” to “var RULE_PATH /opt/local/etc/snort/rules”
goto the line that starts with “# output database: log, mysql, user=” and remove the # from the begining of the line
enter your user password and db name
15. mysql setup
log in to mysql as root
mysql -u root -p

create a snort database
mysql> create database snort;

create a user and password to match your mysql setup in the snort config:
mysql> CREATE USER ‘snort’@’localhost’ IDENTIFIED BY ‘somepassword’;

give that user access to the database
mysql> GRANT ALL PRIVILEGES ON snort.* TO ‘snort’@’localhost’;
mysql> exit

Import the snort schema into the database.
mysql -D snort -u root -p < /schemas/create_mysql

16. Start it up
snort -c /opt/local/etc/snort/snort.conf

If it works it should look something like:
–== Initialization Complete ==–

,,_ -*> Snort! <*-
o” )~ Version (Build 114)
”” By Martin Roesch & The Snort Team:

You can use ctrl+c to stop it.

Debian Boot Thumb drive from OSX

Last week I had a need to create a debian boot disk. The computer I needed to use it on doesn’t have a CD and I didn’t feel like purchasing a USB CD reader just for the purpose of loading debian, and I didn’t feel like waiting until I could go to down or have it shipped.

So I had to make a boot disk. I’ve done it in Linux several times before but never from OSX. So the commands aren’t exactly the same, here are my notes taken from a couple places on the web, which should serve as a reminder for the next time I have do to it.

First I downloaded the debian image I wanted to use from there site.
Next I stuck the thumb drive in the box.
from the termial (I use iTerm)
#diskutil list
mine was listed as /dev/disk1
#diskutil unmountDisk /dev/disk1
#bzcat debian.img | dd of=/dev/disk1
#diskutil eject /dev/disk1

It was a simple as that. To test i stuck it in my handy netbook and reboot and I was at the lovely command prompt. Then of course other things happened that required my attention so I haven’t gotten back to that project of getting the box installed yet.

Checking the Splunk Process from Nagios

Now its time to have Nagios check to make sure that splunk is running. For version 3 of Splunk there was a app / plugin you could get for Splunk that would work with Nagios. It appears to be gone. But I did find a snippet that some one posted here. Several things have changed so that script doesn’t work 100% out by cut and paste, but it was an excellent jumping off point and it took very few modifications to get going. Due to the fact that there is a copy right on this script, then I can’t put it here with out permission. But I will note that you can do the same thing almost by using the default nagios check_procs command.

So copy that script as check_splunk and stick it in your libexec folder. If your playing along with my setup thats: /opt/local/libexec/nagios

Once you have it downloaded you can ./check_splunk ports or procs
I didn’t worry about checking or trying to edit the search portion as for what I’m doing I don’t really need it right now, but I will revisit it if the need arises.

Now you have the script, its time todo the normal nagios setup stuff.
1. Add it to your commands
vi /opt/local/etc/nagios/objects/commands.cfg

define command {
command_name check_splunk
command_line $USER1$/check_splunk $ARG1$

2. Add it to your localhost
vi /opt/local/etc/nagios/objects/localhost.cfg

define service{
use generic-service
host_name localhost
service_description Splunk Port
check_command check_splunk!ports

define service{
use generic-service
host_name localhost
service_description Splunk Procs
check_command check_splunk!procs

Now restart nagios and you should be good to go

Adding Cacti Logs to Splunk

This basically the same process as adding the nagios logs, but I’ll put it up anyway.

1. Click Manager in the upper right-hand corner of Splunk Web.
2. Under System configurations, click Data Inputs.
3. Click Files and directories.
4. Click New to add an input
I choose Monitor a file or directory
6. Specify the path to the file:
With my setup it is:
7. Under Host Heading
I choose constant value
8. Under Source Type
I choose Automatic
9. Click Save

Thats it now your cacti logs show up in splunk.

Checking the OSSEC Processes from Nagios

There are several OSSEC processes that are running at once. So I’ll add some simple process checking to nagios to make sure I know they are running. One note is that if you haven’t enabled the ossec-csyslogd to run (I did that to talk to splunk) then you won’t need that one. So here we go, its easy.

1. Add it to your commands (Note I’m adding a new command for this instead of using the command already there so I can pass some different information, plus I like to keep all my modifications separate to make things easier to reproduce on other boxes)

vi /opt/local/etc/nagios/objects/commands.cfg

# ‘check_ossec_procs’ command definition
define command{
command_name check_ossec_procs
command_line $USER1$/check_procs -c $ARG1$ -C ARG2$

2. Add it to your localhost
vi /opt/local/etc/nagios/objects/localhost.cfg

define service{
use generic-service
host_name localhost
service_description OSSEC csyslogd
check_command check_ossec_procs!1:1!ossec-csyslogd

define service{
use generic-service
host_name localhost
service_description OSSEC maild
check_command check_ossec_procs!1:1!ossec-maild

define service{
use generic-service
host_name localhost
service_description OSSEC execd
check_command check_ossec_procs!1:1!ossec-execd

define service{
use generic-service
host_name localhost
service_description OSSEC analysisd
check_command check_ossec_procs!1:1!ossec-analysisd

define service{
use generic-service
host_name localhost
service_description OSSEC logcollector
check_command check_ossec_procs!1:1!ossec-logcollector

define service{
use generic-service
host_name localhost
service_description OSSEC monitord
check_command check_ossec_procs!1:1!ossec-monitord

Now just reload nagios and you should be able to tell if you ossec process is there or not.

Adding OSSEC Alerts to Splunk

Next up I want to add my OSSEC Alerts to Splunk. This is slightly more complicated then adding the nagios logs, but well document. The main part of this comes from the OSSEC Wiki Here. And the rest from the forums. But I’ll put it all here for my reference.

1. Edit your ossec.conf (If you’ve installed it like I have its located at: /var/ossec/etc/ossec.conf)
add the following block:

2. Enable syslog_output module and restart OSSEC:
#/var/ossec/bin/ossec-control enable client-syslog
#/var/ossec/bin/ossec-control restart

On restart you’ll see ossec-csyslogd starting up.

On the Splunk Side
1. Goto Manager
2. Goto Data Inputs
3. On UDP click Add New
4. On my setup the UPD Port is 10002
5. Set sourcetype is Manual
6. Source type is ossec
7. Save

Now since things have changed in Splunk 4 the rest of the wiki entry doesn’t help. But there is more information on this Forum Thread.

So download that file and extract it to your splunk directory as stated. Restart splunk and bingo your OSSEC alerts plus lots of nice menu options to access that data.