[ossec-list] RV: Rule questions

[Xavier Romero]

Hello all,

I just want this default rule:

<group name="pam,syslog,">
...
  <rule id="5501" level="3">
    <if_sid>5500</if_sid>
    <match>session opened for user </match>
    <description>Login session opened.</description>
    <group>authentication_success,</group>
  </rule>
...
</group>

to avoid alerts for CRON executions like:
=> CRON[23946]: (pam_unix) session opened for user root by (uid=0)

I've tried

  <rule id="100001" level="0">
    <if_sid>5501, 5502</if_sid>
    <match>CRON</match>
    <description>Ignored</description>
  </rule>

and

   <rule id="100001" level="0">
    <if_sid>5500</if_sid>
    <match>CRON</match>
    <match>session opened for user </match>
    <description>Ignored</description>
  </rule>

and

   <rule id="100001" level="0">
    <if_sid>5500</if_sid>
    <match>CRON</match>
    <description>Ignored</description>
  </rule>

But none of these produces the desired effect.

Which is the right way to achieve that?
When there are no more rules executed? First match? Lower level? ...?
What happens when tehre are 2 <match> or 2 <url>..  that acts as OR or as AND 
?!?
<group> have any implication on rules or it's just for logical classification?


Thanks in advance!
Xavier Romero.