I use this simple ruleset to imform when the adsl line goes up and down Output looks like ...
OSSEC HIDS Notification. 2007 Nov 22 02:35:37 Received From: thecla2->/var/log/messages Rule: 101002 fired (level 8) -> "Monitor adsl line up" Portion of the log(s): Nov 22 02:35:36 thecla2 kernel: ATM dev 0: ADSL line is up (2752 kb/s down | 448 kb/s up) --END OF NOTIFICATION Martin West
adsl_rules.xml
Description: XML document
