====== opnSense Cron Jobs ======

===== Overview =====

Basically, it uses [[http://www.manpagez.com/man/8/configd/|configd]], so you have to create a service definition for your new script.
<code>ls /usr/local/opnsense/service/conf/actions.d</code>

Create a file with the name //actions_NAME.conf//, where //NAME// is something meaningful to you. The file should have a basic win ini format, with the action needed, then a bunch of lines describing what to do.

After creating the file, you will need to restart configd, then test your configuration
<code bash>
service configd restart
configctl COMMANDNAME start # or reload, or whatever
</code>
**COMMANDNAME** is the command you created. The filename, without the preceeding //actions_// or the extension

Once this is done, the string after message (or description, I don't know which) will show up as a possible cron job in the opnSense GUI for cron.

You can create multiple actions (stop,start) in the same file with different scripts and/or parameters.

The log files are stored in /var/log/configd.log

===== Examples =====

==== updatedns ====
This will execute the script /root/updateDNS. The file /usr/local/opnsense/service/conf/actions.d/actions_updatedns.conf is created with the following contents
<file name=actions_updatedns.conf>
[reload]
command:/root/updateDNS
parameter:
type:script
message:update Daily Data DNS
description:Update Daily Data DNS
</file>

Note that this uses the **reload** parameter.

Now that you have added a new config, you need to reload configd so it will read it, then test it (we are passing **reload** to it since that is the action we are using)
<code>
service configd restart
configctl updatedns reload
</code>

==== Starting suricata if it dies ====

I ran into a problem where suricata would randomly die on rule rule reload, so I set up a cron job to see if it was running and, if not, start it up

First, I created the file /usr/local/opnsense/service/conf/actions.d/actions_suricata_watchdog.conf
<file name=actions_suricata_watchdog.conf>
[start]
command:/usr/sbin/service suricata status >/dev/null 2>&1 || /usr/sbin/service suricata start
type:script
message:Suricata watchdog: start Suricata if not running
description:Suricata watchdog: start Suricata if not running
</file>

Reloaded configd and tested my config file
<code bash>
service configd restart
configctl suricata_watchdog start
</code>

Then, I went to the opnSense GUI and made a new entry in System | Settings | Cron to run at 14 minutes after the hour, every hour (I can lose a little bit of monitoring, and did not want it running every minute).

Note that I built this totally inside of the config file; no external files to access and run. I just told it to use the command:
<code bash>
/usr/sbin/service suricata status >/dev/null 2>&1 || /usr/sbin/service suricata start
</code>

This is basic shell magic. By calling service suricata status, I'll check the status of suricata. I don't care about the output, so I send STDOUT and STDERR to /dev/null. What I want is the return status, which is false if the service is not running. In that case, the || (OR) will execute the other command, which will start suricata back up.

==== Bibliography ====

  * [[https://docs.opnsense.org/development/backend/configd.html]]
  * [[https://docs.opnsense.org/development/backend.html]]
  * [[https://forum.opnsense.org/index.php?topic=2263.0]]
  * [[http://www.manpagez.com/man/8/configd/]]