Having problems with your account or logging in?
A lot of changes are happening in the community right now. Some may affect you. READ MORE HERE
Honored Contributor.. yurlov.a Honored Contributor..
Honored Contributor..
542 views

Execute Command action problem with perl

Hi all.

Recently I faced the problem with Execute Command action in test rule. I created the perl script to run some actions on manager. My step by step actions:

1. Necessary perl library was installed under root user.

2. Perl script test.pl was created. It works perfectly under root and arcsight from linux console. So arcsight user can run perl.pl (it has all necessary permissions - 0777).

3. This is my action config in ArcSight Console:

4. It does't work! I can see event "ExecuteCommand: Failure" in Manager Internal Connector as below:

5. Some interesting things...

     5.1 This is not my first integreation of the same action! I use python script, that works properly. It was configured by the same way.

     5.2 Simple commands like ls, mv, etc. works.

     5.3 I even deleted script and edit action config as below:

I don't know more simple way to test perl

But it not working too! I can execute perl -v command at manager host from linux console at the same time

     5.4 If I combine two actions with python and perl scripts, only python script works with "ExecuteCommand: Success" event and I can see result of it work. So rule is correct!

I should be gratefull for every advice to resolve my problem!

Regards,

Alexander

Labels (1)
0 Likes
6 Replies
Super Contributor.. kUMters Super Contributor..
Super Contributor..

Re: Execute Command action problem with perl

Have you tried to call that perl command with full path?

Solution Security Architect
0 Likes
Highlighted
Rodion Super Contributor.
Super Contributor.

Re: Execute Command action problem with perl

0 Likes
Honored Contributor.. yurlov.a Honored Contributor..
Honored Contributor..

Re: Execute Command action problem with perl

Hi, Peter.
Thanks for your answer. Yes, I call this command with full path (you may see that on first screenshot). In addition, I tried /usr/bin/perl instead perl.

Regards,

Alexander

0 Likes
Honored Contributor.. yurlov.a Honored Contributor..
Honored Contributor..

Re: Execute Command action problem with perl

Hi, Rodion.
Thanks for your answer. It's very interesting post, but to show technical implementation I should share other interesting content from Knight:

It is very good script with great instruction. It works properly at my ArcSight environment.
There is one thing which brings me to the confusion: only perl implementation doesn't work. I'll try create python version soon...

Regards,

Alexander

0 Likes
Honored Contributor.. yurlov.a Honored Contributor..
Honored Contributor..

Re: Execute Command action problem with perl

I have developed the python script to do the same actions. Now I have two scripts: perl and python. Python script works properly for me.

But I can not uderstand the cause perl version is not working via ArcSight Console configuration...

So, I recommend avoiding perl actions implementations in your rules. Maybe, this post will be useful to somebody.

Regards,

Alexander

0 Likes
Honored Contributor.. yurlov.a Honored Contributor..
Honored Contributor..

Re: Execute Command action problem with perl

There is one addition. Recently I have tested perl -v execution by other manager. It works! My conclusion is my first manager has some problems with perl libraries.

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.