A remediation script is run on the machine that you specify in the remediation script configuration. You can run the script from the machine affected by the violation that triggered the action or from a central management server. It is not necessary for an app agent to be running on the machine on which the script executes; just a Machine Agent.
By default, the script is a shell script in /bin/sh invoked with the -ex option, unless the script has a header, in which case the interpreter in the header is used. For example, if the script header is #!/bin/perl, the Perl interpreter is invoked.
A process exit code of zero indicates that the script execution succeeded. A non-zero exit code indicates that it failed.
The script should be written as generically as possible to allow it to run on any of the nodes for which is it invoked. exports the following environment variables to the script runtime to provide context regarding the environment and the event that triggered the action.
|
Remediation scripts must be stored in a sub-directory of the machine agent installation. The sub-directory must be named local-scripts. The following paths are all valid.
${machine.agent.home}/local-scripts/runMe.sh
${machine.agent.home}/local-scripts/johns_scripts/runMe.sh
${machine.agent.home}/local-scripts/ops/johns_scripts/runMe.sh |
To troubleshoot your remediation script, look for the process in the Machine Agent log. The log location path is: <machine_agent_home>/logs/machine-agent.log
This snippet from the Machine Agent log shows both error and success messages from running a local script named script.sh.
