Hi Xavier, this
<rule id="100001" level="0"> means, ignore and take no action. Please try "level > 0, maybe 3. Have a look there: http://www.ossec.net/wiki/index.php/Know_How:Rules_Severity By, Thomas. Xavier Romero schrieb: > Hello all, > > I just want this default rule: > > <group name="pam,syslog,"> > ... > <rule id="5501" level="3"> > <if_sid>5500</if_sid> > <match>session opened for user </match> > <description>Login session opened.</description> > <group>authentication_success,</group> > </rule> > ... > </group> > > to avoid alerts for CRON executions like: > => CRON[23946]: (pam_unix) session opened for user root by (uid=0) > > I've tried > > <rule id="100001" level="0"> > <if_sid>5501, 5502</if_sid> > <match>CRON</match> > <description>Ignored</description> > </rule> > > and > > <rule id="100001" level="0"> > <if_sid>5500</if_sid> > <match>CRON</match> > <match>session opened for user </match> > <description>Ignored</description> > </rule> > > and > > <rule id="100001" level="0"> > <if_sid>5500</if_sid> > <match>CRON</match> > <description>Ignored</description> > </rule> > > But none of these produces the desired effect. > > Which is the right way to achieve that? > When there are no more rules executed? First match? Lower level? ...? > What happens when tehre are 2 <match> or 2 <url>.. that acts as OR or as AND > ?!? > <group> have any implication on rules or it's just for logical classification? > > > Thanks in advance! > Xavier Romero. -- Chirado OHG Thomas K. Rosin Telefon: 02181 2156701 Telefax: 02181 2156708 E-Mail: [email protected] GnuPG-/PGP-Schlüssel auf Anfrage ----------------------------------- Informationen zum Unternehmen: Chirado OHG Unterstraße 61 41516 Grevenbroich Geschäftsführende Gesellschafter: Alexander Hoff, Thomas K. Rosin Sitz: Grevenbroich Gerichtsstand: Mönchengladbach Handelsregistereintrag: HRA 4940 USt.-IdNr.: DE215386270
