/ 
Monitoring-Sneck-Checks-0.0.2
/ Monitoring::Sneck::Checks::pkg_audit

NAME

Monitoring::Sneck::Checks::pkg_audit - checks FreeBSD packages for known vulnerabilities

VERSION

Version 0.0.1

SYNOPSIS

!pkg_audit|interval=3600|perl:pkg_audit
!pkg_audit_www|interval=3600|perl:pkg_audit -j www
!pkg_audit_fetch|interval=86400 timeout=300|perl:pkg_audit -F -w 0 -c 5

DESCRIPTION

Runs pkg audit and counts the installed packages it says are vulnerable. By default any is CRITICAL.

pkg audit goes by the vulnerability database it has, which the daily periodic security run fetches. A database older than --max-age days is WARNING, as it may be missing what was found since, the same as periodic warns. With --fetch, pkg fetches it first, which needs the network and should not be done every few minutes, so use a compliance check with a interval, as in the synopsis.

pkg failing, or not being there, is UNKNOWN.

OPTIONS

- -j, --jail :: Audit the packages in this jail, through pkg -j. The age of the database is not checked unless --db is given.

- -F, --fetch :: Fetch the vulnerability database first.

- -d, --db :: The vulnerability database. Default :: /var/db/pkg/vuln.xml

- -a, --max-age :: Days old the database may be. 0 to not check it. Default :: 2

- -w, --warning :: Range for the number of vulnerable packages.

- -c, --critical :: Range for the number of vulnerable packages. Default :: 0

METHODS

check

Does the check.

db_age

Returns the days since the vulnerability database was changed, or undef if it is not checked, as for a jail without --db, or not there.