#!/bin/sh
# https://kifarunix.com/run-multiple-filebeat-instances-in-linux/
# vendor prefix.
# Check for missing binaries (stale symlinks should not happen)
# Note: Special treatment of stop for LSB conformance
BEAT_BIN=/usr/share/auditbeat/bin/auditbeat
test -x $BEAT_BIN || { echo "$BEAT_BIN not installed"; 
	if [ "$1" = "stop" ]; then exit 0;
	else exit 5; fi; }

# Check for existence of needed config file and read it
BEAT_CONFIG=/etc/auditbeat/auditbeat.yml
test -r $BEAT_CONFIG || { echo "$BEAT_CONFIG not existing";
	if [ "$1" = "stop" ]; then exit 0;
	else exit 6; fi; }

# Check OS Type SLES/RHEL

if test -e /etc/rc.status ; then
			# Shell functions sourced from /etc/rc.status:
			#      rc_check         check and set local and overall rc status
			#      rc_status        check and set local and overall rc status
			#      rc_status -v     be verbose in local rc status and clear it afterwards
			#      rc_status -v -r  ditto and clear both the local and overall rc status
			#      rc_status -s     display "skipped" and exit with status 3
			#      rc_status -u     display "unused" and exit with status 3
			#      rc_failed        set local and overall rc status to failed
			#      rc_failed <num>  set local and overall rc status to <num>
			#      rc_reset         clear both the local and overall rc status
			#      rc_exit          exit appropriate to overall rc status
			#      rc_active        checks whether a service is activated by symlinks
			. /etc/rc.status
			# Reset status of this service
			rc_reset
			# Return values acc. to LSB for all commands but status:
			# 0	  - success
			# 1       - generic or unspecified error
			# 2       - invalid or excess argument(s)
			# 3       - unimplemented feature (e.g. "reload")
			# 4       - user had insufficient privileges
			# 5       - program is not installed
			# 6       - program is not configured
			# 7       - program is not running
			# 8--199  - reserved (8--99 LSB, 100--149 distrib, 150--199 appl)
			# 
			# Note that starting an already running service, stopping
			# or restarting a not-running service as well as the restart
			# with force-reload (in case signaling is not supported) are
			# considered a success.
			agent=${BEATSNAME-/usr/share/auditbeat/bin/auditbeat}
            args="-c /etc/auditbeat/auditbeat.yml --path.home /usr/share/auditbeat --path.config /etc/auditbeat --path.data /var/lib/auditbeat --path.logs /var/log/auditbeat"
            wrapper="/usr/share/auditbeat/bin/auditbeat-god"
            wrapperopts="-r / -n "


			case "$1" in
				start)
				echo -n "Starting auditbeat "
				## Start daemon with startproc(8). If this fails
				## the return value is set appropriately by startproc.
				/sbin/startproc $wrapper $wrapperopts -- $agent $args

				# Remember status and be verbose
				rc_status -v
				;;
				stop)
				echo -n "Shutting down auditbeat "
				## Stop daemon with killproc(8) and if this fails
				## killproc sets the return value according to LSB.

				/sbin/killproc -TERM $BEAT_BIN

				# Remember status and be verbose
				rc_status -v
				;;
				try-restart|condrestart)
				## Do a restart only if the service was active before.
				## Note: try-restart is now part of LSB (as of 1.9).
				## RH has a similar command named condrestart.
				if test "$1" = "condrestart"; then
					echo "${attn} Use try-restart ${done}(LSB)${attn} rather than condrestart ${warn}(RH)${norm}"
				fi
				$0 status
				if test $? = 0; then
					$0 restart
				else
					rc_reset	# Not running is not a failure.
				fi
				# Remember status and be quiet
				rc_status
				;;
				restart)
				## Stop the service and regardless of whether it was
				## running or not, start it again.
				$0 stop
				$0 start

				# Remember status and be quiet
				rc_status
				;;
				force-reload)
				## Signal the daemon to reload its config. Most daemons
				## do this on signal 1 (SIGHUP).
				## If it does not support it, restart the service if it
				## is running.

				echo -n "Reload service auditbeat "
				## if it supports it:
				/sbin/killproc -HUP $BEAT_BIN
				#touch /var/run/FOO.pid
				rc_status -v

				## Otherwise:
				#$0 try-restart
				#rc_status
				;;
				reload)
				## Like force-reload, but if daemon does not support
				## signaling, do nothing (!)

				# If it supports signaling:
				echo -n "Reload service auditbeat "
				/sbin/killproc -HUP $BEAT_BIN
				#touch /var/run/FOO.pid
				rc_status -v
				
				## Otherwise if it does not support reload:
				#rc_failed 3
				#rc_status -v
				;;
				status)
				echo -n "Checking for service auditbeat "
				## Check status with checkproc(8), if process is running
				## checkproc will return with exit status 0.

				# Return value is slightly different for the status command:
				# 0 - service up and running
				# 1 - service dead, but /var/run/  pid  file exists
				# 2 - service dead, but /var/lock/ lock file exists
				# 3 - service not running (unused)
				# 4 - service status unknown :-(
				# 5--199 reserved (5--99 LSB, 100--149 distro, 150--199 appl.)
				
				# NOTE: checkproc returns LSB compliant status values.
				/sbin/checkproc $BEAT_BIN
				# NOTE: rc_status knows that we called this init script with
				# "status" option and adapts its messages accordingly.
				rc_status -v
				;;
				probe)
				## Optional: Probe for the necessity of a reload, print out the
				## argument to this init script which is required for a reload.
				## Note: probe is not (yet) part of LSB (as of 1.9)

				test /etc/auditbeat/auditbeat.yml -nt /var/run/auditbeat.pid && echo reload
				;;
				*)
				echo "Usage: $0 {start|stop|status|restart|reload}"
				exit 1
				;;
			esac
		rc_exit
elif test -e /etc/rc.d/init.d/functions ; then
        PATH=/usr/bin:/sbin:/bin:/usr/sbin
		export PATH

		[ -f /etc/sysconfig/auditbeat ] && . /etc/sysconfig/auditbeat
		pidfile=${PIDFILE-/var/run/auditbeat.pid}
		agent=${BEATS_AGENT-/usr/share/auditbeat/bin/auditbeat}
		args="-c /etc/auditbeat/auditbeat.yml --path.home /usr/share/auditbeat --path.config /etc/auditbeat --path.data /var/lib/auditbeat --path.logs /var/log/auditbeat"
		test_args="-e test config"
		beat_user="${BEAT_USER:-root}"
		wrapper="/usr/share/auditbeat/bin/auditbeat-god"
		wrapperopts="-r / -n -p $pidfile"
		user_wrapper="su"
		user_wrapperopts="$beat_user -c"
		RETVAL=0

		# Source function library.
		. /etc/rc.d/init.d/functions

		# Determine if we can use the -p option to daemon, killproc, and status.
		# RHEL < 5 can't.
		if status | grep -q -- '-p' 2>/dev/null; then
			daemonopts="--pidfile $pidfile"
			pidopts="-p $pidfile"
		fi

		if command -v runuser >/dev/null 2>&1; then
			user_wrapper="runuser"
		fi

		[ "$beat_user" != "root" ] && wrapperopts="$wrapperopts -u $beat_user"

		test() {
			$user_wrapper $user_wrapperopts "$agent $args $test_args"
		}

		start() {
			echo -n $"Starting auditbeat: "
			test
			if [ $? -ne 0 ]; then
				echo
				exit 1
			fi
			daemon $daemonopts $wrapper $wrapperopts -- $agent $args
			RETVAL=$?
			echo
			return $RETVAL
		}

		stop() {
			echo -n $"Stopping auditbeat: "
			killproc $pidopts $wrapper
			RETVAL=$?
			echo
			[ $RETVAL = 0 ] && rm -f ${pidfile}
		}

		restart() {
			test
			if [ $? -ne 0 ]; then
				return 1
			fi
			stop
			start
		}

		rh_status() {
			status $pidopts $wrapper
			RETVAL=$?
			return $RETVAL
		}

		rh_status_q() {
			rh_status >/dev/null 2>&1
		}

		case "$1" in
			start)
				start
			;;
			stop)
				stop
			;;
			restart)
				restart
			;;
			condrestart|try-restart)
				rh_status_q || exit 0
				restart
			;;
			status)
				rh_status
			;;
			*)
				echo $"Usage: $0 {start|stop|status|restart|condrestart}"
				exit 1
		esac
		exit $RETVAL
fi




