Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use launchctl to start and stop macos agent #7498

Conversation

mjcr99
Copy link
Member

@mjcr99 mjcr99 commented Jul 3, 2024

Description

Related Issue
#6359

Hi team, this PR replaces the /Library/Ossec/bin/wazuh-control command usage with launchctl to start and stop the Wazuh agent service.

Test

Starting with a stopped agent:

sh-3.2# /Library/Ossec/bin/wazuh-control status
wazuh-modulesd not running...
wazuh-logcollector not running...
wazuh-syscheckd not running...
wazuh-agentd not running...
wazuh-execd not running...

The service is launched:

sh-3.2# sudo launchctl load /Library/LaunchDaemons/com.wazuh.agent.plist

The service status is shown currently in both launchctl command and /Library/Ossec/bin/wazuh-control:


sh-3.2# /Library/Ossec/bin/wazuh-control status
cat: /Library/Ossec/var/start-script-lock/pid: No such file or directory
wazuh-modulesd is running...
wazuh-logcollector is running...
wazuh-syscheckd is running...
wazuh-agentd is running...
wazuh-execd is running...

sh-3.2# launchctl print system/com.wazuh.agent
com.wazuh.agent = {
	active count = 1
	copy count = 0
	one shot = 0
	path = /Library/LaunchDaemons/com.wazuh.agent.plist
	state = running

	program = /Library/StartupItems/WAZUH/Wazuh-launcher
	arguments = {
		/Library/StartupItems/WAZUH/Wazuh-launcher
	}

	default environment = {
		PATH => /usr/bin:/bin:/usr/sbin:/sbin
	}

	environment = {
		XPC_SERVICE_NAME => com.wazuh.agent
	}

	domain = com.apple.xpc.launchd.domain.system
	minimum runtime = 10
	exit timeout = 5
	runs = 1
	successive crashes = 0
	pid = 4517
	immediate reason = speculative
	forks = 3
	execs = 2
	initialized = 1
	trampolined = 1
	started suspended = 0
	proxy started suspended = 0
	last exit code = (never exited)

	event triggers = {
	}

	endpoints = {
	}

	dynamic endpoints = {
	}

	pid-local endpoints = {
	}

	instance-specific endpoints = {
	}

	event channels = {
	}

	sockets = {
	}

	instances = {
	}

	spawn type = daemon
	spawn role = (null)
	jetsam priority = 3
	jetsam memory limit (active) = (unlimited)
	jetsam memory limit (inactive) = (unlimited)
	jetsamproperties category = daemon
	submitted job. ignore execute allowed
	jetsam thread limit = 32
	cpumon = default

	properties = {
		partial import = 0
		launchd bundle = 0
		xpc bundle = 0
		keepalive = 0
		runatload = 1
		low priority i/o = 0
		low priority background i/o = 0
		dataless file mode = 0
		legacy timer behavior = 0
		exception handler = 0
		multiple instances = 0
		supports transactions = 0
		supports pressured exit = 0
		supports idle hysteresis = 0
		enter kdp before kill = 0
		wait for debugger = 0
		app = 0
		system app = 0
		creates session = 0
		inetd-compatible = 0
		inetd listener = 0
		abandon process group = 0
		one-shot = 0
		event monitor = 0
		penalty box = 0
		pended non-demand spawn = 0
		role account = 0
		launch only once = 0
		system support = 0
		app-like = 0
		inferred program = 1
		joins gui session = 0
		joins host session = 0
		parameterized sandbox = 1
		resolve program = 0
		abandon coalition = 0
		high bits aslr = 0
		extension = 0
		nano allocator = 0
		no initgroups = 0
		start on fs mount = 0
		endpoints initialized = 1
		is copy = 0
		disallow all lookups = 0
		system service = 0
		protected by submitter = 0
	}
}

Then the service is stopped:

sh-3.2# sudo launchctl unload /Library/LaunchDaemons/com.wazuh.agent.plist
/Library/LaunchDaemons/com.wazuh.agent.plist: Operation now in progress

And checking its status, it's not running, as expected:

sh-3.2# /Library/Ossec/bin/wazuh-control status
wazuh-modulesd not running...
wazuh-logcollector not running...
wazuh-syscheckd not running...
wazuh-agentd not running...
wazuh-execd not running...

Checks

Docs building

  • Compiles without warnings.

Code formatting and web optimization

  • Uses three spaces indentation.
  • Adds or updates meta descriptions accordingly.
  • Updates the redirects.js script if necessary (check this guide).

Writing style

  • Uses present tense, active voice, and semi-formal registry.
  • Uses short, simple sentences.
  • Uses bold for user interface elements, italics for key terms or emphasis, and code font for Bash commands, file names, REST paths, and code.

@mjcr99 mjcr99 force-pushed the enhancement/6359-improve-on-instructions-on-how-to-install-and-uninstall-the-wazuh-macos-agent branch from 7d30e2a to 8d905ba Compare July 4, 2024 09:41
@mjcr99 mjcr99 force-pushed the enhancement/6359-improve-on-instructions-on-how-to-install-and-uninstall-the-wazuh-macos-agent branch from 8d905ba to e4c3541 Compare July 8, 2024 14:14
MarcelKemp
MarcelKemp previously approved these changes Jul 8, 2024
@MarcelKemp MarcelKemp requested a review from javimed July 8, 2024 17:03
@javimed javimed added level/task Task issue type/enhancement Enhancement issue labels Jul 8, 2024
@javimed
Copy link
Member

javimed commented Jul 11, 2024

I'm just mentioning that we're using # prompt with sudo here.

@javimed javimed merged commit 12ee5de into 4.10.0 Jul 11, 2024
3 checks passed
@javimed javimed deleted the enhancement/6359-improve-on-instructions-on-how-to-install-and-uninstall-the-wazuh-macos-agent branch July 11, 2024 15:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
level/task Task issue type/enhancement Enhancement issue
Projects
No open projects
Status: Done
Development

Successfully merging this pull request may close these issues.

Improve on instructions on how to install and uninstall the Wazuh macOS agent
3 participants