Differences

This shows you the differences between two versions of the page.

--- other:networking:opnsense:cron-jobs [2020/01/11 19:17] – created - external edit 127.0.0.1
+++ other:networking:opnsense:cron-jobs [2026/07/17 01:51] (current) – rodolico
@@ Line 1: / Line 1: @@
 ====== opnSense Cron Jobs ======
+===== Overview =====
 Basically, it uses [[http://www.manpagez.com/man/8/configd/|configd]], so you have to create a service definition for your new script.
-<code>
+<code>ls /usr/local/opnsense/service/conf/actions.d</code>
-cd /usr/local/opnsense/service/conf/actions.d
-</code>
 Create a file with the name //actions_NAME.conf//, where //NAME// is something meaningful to you. The file should have a basic win ini format, with the action needed, then a bunch of lines describing what to do.
-Example of a file named actions_updatedns.conf:
+After creating the file, you will need to restart configd, then test your configuration
+<code bash>
+service configd restart
+configctl COMMANDNAME start # or reload, or whatever
+</code>
+**COMMANDNAME** is the command you created. The filename, without the preceeding //actions_// or the extension
+Once this is done, the string after message (or description, I don't know which) will show up as a possible cron job in the opnSense GUI for cron.
+You can create multiple actions (stop,start) in the same file with different scripts and/or parameters.
+The log files are stored in /var/log/configd.log
+===== Examples =====
+==== updatedns ====
+This will execute the script /root/updateDNS. The file /usr/local/opnsense/service/conf/actions.d/actions_updatedns.conf is created with the following contents
 <file name=actions_updatedns.conf>
 [reload]
@@ Line 18: / Line 34: @@
 </file>
-Now that you have added a new config, you need to reload configd so it will read it:
+Note that this uses the **reload** parameter.
+Now that you have added a new config, you need to reload configd so it will read it, then test it (we are passing **reload** to it since that is the action we are using)
 <code>
 service configd restart
-</code>
-And, test that you did everything right
-<code>
 configctl updatedns reload
 </code>
-the script /root/updateDNS will be run. You can create multiple actions (stop,start) in the same file with different scripts and/or parameters.
-Once this is done, the string after message (or description, I don't know which) will show up as a possible cron job in the opnSense GUI
+==== Starting suricata if it dies ====
-The log files are stored in /var/log/configd.log
+I ran into a problem where suricata would randomly die on rule rule reload, so I set up a cron job to see if it was running and, if not, start it up
+First, I created the file /usr/local/opnsense/service/conf/actions.d/actions_suricata_watchdog.conf
+<file name=actions_suricata_watchdog.conf>
+[start]
+command:/usr/sbin/service suricata status >/dev/null 2>&1 || /usr/sbin/service suricata start
+type:script
+message:Suricata watchdog: start Suricata if not running
+description:Suricata watchdog: start Suricata if not running
+</file>
+Reloaded configd and tested my config file
+<code bash>
+service configd restart
+configctl suricata_watchdog start
+</code>
+Then, I went to the opnSense GUI and made a new entry in System | Settings | Cron to run at 14 minutes after the hour, every hour (I can lose a little bit of monitoring, and did not want it running every minute).
+Note that I built this totally inside of the config file; no external files to access and run. I just told it to use the command:
+<code bash>
+/usr/sbin/service suricata status >/dev/null 2>&1 || /usr/sbin/service suricata start
+</code>
+This is basic shell magic. By calling service suricata status, I'll check the status of suricata. I don't care about the output, so I send STDOUT and STDERR to /dev/null. What I want is the return status, which is false if the service is not running. In that case, the || (OR) will execute the other command, which will start suricata back up.
 ==== Bibliography ====