FIM System tests: 0212 - Realtime + Scheduled

[spothound]

Hello team,

This issue is related to #493. It will contain the advances related to the creation of the scenario 0212

Objectives

Implement scenario 212.

This scenario tests realtime when there are missing alerts due to queue full. These alerts must be regenerated in the following scheduled scan. We want to check the delay between events and alerts when this happen.

Warning in Linux:

WARNING: Real-time inotify kernel queue is full. Some events may be lost. Next scheduled scan will recover lost data.

Warning in windows:

 WARNING: (6906): Real time process: no data. Probably buffer overflow.

Tasks

• Create ossec.conf files
• Create launch_scenario.yml
• • Create/Delete/modify the necessary files
• • Check alerts in alerts.json.
• • Check alerts in Elasticsearch.

Regards,
Francisco Navarro.

[spothound]

Working on https://github.com/wazuh/wazuh-qa/tree/feature-556-realtime-scheduled-scenario

[spothound]

Testing

Automatic

Execution 0 (Syscheck frequency of 600 seconds)

{
    "root_folder": "{{ agents_fim_testing_path }}",
    "recursion_level": 3,
    "folder_length": 5,
    "file_length": 5,
    "file_size_specifications":[
        { "size": 10240, "amount": 4000},
        { "size": 524288, "amount": 500},
        { "size": 1048576, "amount": 500},
        { "size": 10485760, "amount": 10}
    ]
}

SUCCESS

PLAY RECAP ***********************************************************************************************************
172.16.0.111               : ok=20   changed=11   unreachable=0    failed=0    skipped=26   rescued=0    ignored=0   
172.16.0.131               : ok=17   changed=11   unreachable=0    failed=0    skipped=29   rescued=0    ignored=0   
172.16.0.141               : ok=17   changed=11   unreachable=0    failed=0    skipped=29   rescued=0    ignored=0   
172.16.0.161               : ok=4    changed=0    unreachable=0    failed=0    skipped=42   rescued=0    ignored=0   

Add files:

Scan frequency: 600

Linux realtime overflow: NO
Windows realtime overflow: Yes

Modify files:

Linux realtime overflow: NO
Windows realtime overflow: Yes

[spothound]

Testing

Automatic

Execution 1 (Syscheck frequency of 600 seconds)

{
    "root_folder": "{{ agents_fim_testing_path }}",
    "recursion_level": 4,
    "folder_length": 5,
    "file_length": 5,
    "file_size_specifications":[
        { "size": 10240, "amount": 10000},
        { "size": 524288, "amount": 5000},
        { "size": 1048576, "amount": 500},
        { "size": 10485760, "amount": 100}
    ]
}

SUCCESS

PLAY RECAP ***********************************************************************************************************
172.16.0.111               : ok=20   changed=11   unreachable=0    failed=0    skipped=26   rescued=0    ignored=0   
172.16.0.131               : ok=17   changed=9    unreachable=0    failed=0    skipped=29   rescued=0    ignored=0   
172.16.0.141               : ok=17   changed=9    unreachable=0    failed=0    skipped=29   rescued=0    ignored=0   
172.16.0.161               : ok=4    changed=0    unreachable=0    failed=0    skipped=42   rescued=0    ignored=0

Linux realtime overflow: YES
Windows realtime overflow: Yes

Graphs

Add

Modify

Linux realtime overflow: NO
Windows realtime overflow: NO