Hi Dominique, Yes, you are right, they are not supposed to have the same id. I will fix that for the next version...
Thanks, -- Daniel B. Cid dcid ( at ) ossec.net On Nov 19, 2007 11:57 AM, Dominique Karg <[EMAIL PROTECTED]> wrote: > > Parsing the files for identifiers I noticed a possible error on one of > them. > > I'm not quite confident with OSSEC internals yet, but hasn't the > identifier to be unique ? > > <rule id="2831" level="0"> > <if_sid>2830</if_sid> > <match>^unable to exec</match> > <description>Wrong crond configuration</description> > </rule> > > <rule id="2831" level="5"> > <if_sid>2830</if_sid> > <match>BEGIN EDIT</match> > <description>Crontab opened for editing.</description> > </rule> > > > I guess it's not intended to have both of those events show up with > the same ID. > > Greetings, > > Dominique >
