It basically alerts you about an icreased number of messages in /var/log/apache2/access.log.
Until "now" the average was of "102", but the current number is higher (353) than the previous average. Of course this doesn't mean you are under attack, but under certain circumstances this could sounds like "hey, dude, there could be something goin on here..." ;) Hope it helps Will Gansert, Matthew A wrote: > Hi List. What's this? > > 2008 Apr 14 17:43:22 Rule Id: 11 > <http://www.ossec.net/wiki/index.php/Rule:11> level: 8 > Location: qcwl99a8t->/var/log/apache2/access.log > Src IP: 10.41.6.108 > Excessive number of events (above normal). > The average number of logs between 17:00 and 18:00 is 102. We reached 353. > > I see an explaination here ( > http://www.ossec.net/wiki/index.php/High_CPU_usage_on_Windows_agent ), > but I'm not sure I understand what is going on. > > Matt > > ------------------------------------------ > The contents of this message, together with any attachments, are > intended only for the use of the person(s) to which they are addressed > and may contain confidential and/or privileged information. Further, any > medical information herein is confidential and protected by law. It is > unlawful for unauthorized persons to use, review, copy, disclose, or > disseminate confidential medical information. If you are not the > intended recipient, immediately advise the sender and delete this > message and any attachments. Any distribution, or copying of this > message, or any attachment, is prohibited. -- +----------------------------------------------------+ | William Maddler | +----------------------------------------------------+ | Visit my blog at http://www.eth0.it | | eth0 / ifconfig realworld up! | +----------------------------------------------------+ | gpg fingerprint: | | EAAA 5A70 0359 ECEC 1167 D81E 3ED7 87C1 29EE 144Aa | +----------------------------------------------------+
