Ossec is warning you that it may be using excessive amount of resources that it should for whatever reason and this might affect the performance of the box.
However I don't think that is such an issue because it is quite low compared to their example, if this is a constant patern of this error message or it is affecting resources you may want to disable it's auditing as suggested in the link you put. Another theory however is because it is the access log for apache and the source IP address is a single address (though an internal address), it may represent an attempted denial of service attack (an attack to use up excessive resources causing the system/application to crash or be unable to serve legitimate requests). It is quite high for a single host to generate that much apache access requests unless you know what is at that source address. It may also represent a possible scan or worm traffic. Probably is legit though Subject: [ossec-list] unusual error message Date: Mon, 14 Apr 2008 17:51:34 -0400 From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Hi List. What's this? 2008 Apr 14 17:43:22 Rule Id: 11 level: 8 Location: qcwl99a8t->/var/log/apache2/access.log Src IP: 10.41.6.108 Excessive number of events (above normal). The average number of logs between 17:00 and 18:00 is 102. We reached 353. I see an explaination here ( http://www.ossec.net/wiki/index.php/High_CPU_usage_on_Windows_agent ), but I'm not sure I understand what is going on. Matt ------------------------------------------ The contents of this message, together with any attachments, are intended only for the use of the person(s) to which they are addressed and may contain confidential and/or privileged information. Further, any medical information herein is confidential and protected by law. It is unlawful for unauthorized persons to use, review, copy, disclose, or disseminate confidential medical information. If you are not the intended recipient, immediately advise the sender and delete this message and any attachments. Any distribution, or copying of this message, or any attachment, is prohibited. _________________________________________________________________ Win 100’s of Virgin Experience days with BigSnapSearch.com http://www.bigsnapsearch.com
