#!/bin/bash
. /etc/default/rkhunter
OUTPUT=`/usr/bin/nice -n 19 /usr/bin/rkhunter --cronjob --report-warnings-only`
if [ "$OUTPUT" == "" ]; then
  OUTPUT="No warnings found"
fi
CODE=$?
# Force everything that isn't OK to be a WARNING
if [ $CODE -gt 0 ]; then
  CODE=1
fi
printf "<%= @fqdn %>\trkhunter warnings\t$CODE\t$OUTPUT\n" | /usr/sbin/send_nsca -H alert.cluster >/dev/null
exit $?

#!/bin/bash
. /etc/default/rkhunter
OUTPUT=`/usr/bin/nice -n 19 /usr/bin/rkhunter --cronjob --report-warnings-only`
CODE=$?
if [ "$OUTPUT" == "" ]; then
  OUTPUT="No warnings found"
fi
# Force everything that isn't OK to be a WARNING
if [ $CODE -gt 0 ]; then
  CODE=1
fi
printf "<%= @fqdn %>\trkhunter warnings\t$CODE\t$OUTPUT\n" | /usr/sbin/send_nsca -H alert.cluster >/dev/null
exit $?

Fix exit code check for rkhunter passive alert
Fix exit code check for rkhunter passive alert

The variable `$CODE` was being assigned later than it should have
been to check the result of the rkhunter run.

This means that we ended up in the state where rkhunter exited with
a non-zero exit code because it found something which it considered
a warning, but the Icinga alert had a code of zero (OK).
