Hi Jonny,
You certainly can do that. By default OSSEC categorizes every successful login
as "authentication_success", so if you add the following to
/var/ossec/rules/local_rules.xml :
<rule id="100005" level="3">
<if_group>authentication_success</if_group>
<options>alert_by_email</options>
<description>My rule to group all authentication successes and
email me</description>
</rule>
It will generate an e-mail for every login. You also mentioned that
you want to ignore
the logins on a few systems, so you can add another rule to do that
(note that enigma
and system2 are the hosts I am ignoring on this example --just change
to whatever
you want):
<rule id="100006" level="3">
<if_sid>100005</if_sid>
<description>My rule to group all authentication successes -dont
email for these systems</description>
<hostname>enigma|system2</hostname>
</rule>
Hope it helps.
--
Daniel B. Cid
dcid ( at ) ossec.net
On Fri, Sep 5, 2008 at 8:47 AM, <[EMAIL PROTECTED]> wrote:
>
> On Thu, Sep 04, 2008 at 03:11:25PM -0700, Jonny Gerold wrote:
>>
>> I would like to set up a filter that tells me successfully login's. And
>> I would like to do this on all my systems except about 5. Is there a
>> rule that I can enable to email me on successful login's, and then just
>> disable it for the servers that I don't care to be alerted.
>
> Let me know if you get this figured out. I am trying to get
> notification of all logins on a single system so I have added the two
> rules which I think should effect that notification, but I have thus far
> been unable to get it working.
>
>
>
>
>
