How to automatically remove inactive OSSEC agents (batch)

Question

As part of some batch "bash" program, how can I automatically remove inactive ossec agents in cases of autoscaling groups where instances are created/deleted constantly?

Answer 1

Here is a quick script you can run to remove 'Disconnected' and 'Never connected' agents

for OUTPUT in $(/var/ossec/bin/agent_control -l | grep -E 'Disconnected|Never' | tr ':' ',' | cut -d "," -f 2 )
do
  /var/ossec/bin/manage_agents -r $OUTPUT
done

Answer 2

#This is to be run on ossec server, path for ossec is /var/ossec/

    file=agents.txt
    /var/ossec/bin/agent_control -l > $file

#Wipe working tmp files
    rm remove.txt
    rm removed.txt
    echo -n "" > remove.txt
    echo -n "" > removed.txt

#Find Disconnected agents
    while IFS= read -r line
    do
    ids=$(echo $line | awk '{print $2}')
    status=$(echo $line | awk '{print $NF}')

    if [ "$status" == "Disconnected" ]; then
    echo $ids >> remove.txt
    fi
    done < "$file"

#Find Never connected agents
    while IFS= read -r line
    do
    ids=$(echo $line | awk '{print $2}')
    status=$(echo $line | awk '{ if (NF > 1) print $(NF-1),$NF ; else print $NF; }')

    if [ "$status" == "Never connected" ]; then
       echo $ids >> remove.txt
    fi

    done < "$file"

#Remove commas 
    sed 's/.$//' remove.txt > removed.txt

#Remove agents with IDs in removed.txt file
    file2=removed.txt

    while IFS= read -r line
    do
    /var/ossec/bin/manage_agents -r "$line"
    done < $file2

#Restart OSSEC service
    /var/ossec/bin/ossec-control restart
#End