Hello,
Thank you and previous answer from Rick McClinton.
I finally got it all after discovering contrib binary ossec-logtest which
pointed me to the <program_name> parameter as Rick mentioned.
I finally got what I wanted by doing:
<rule id="100001" level="0">
<if_sid>5500</if_sid>
<program_name>CRON</program_name>
</rule>
Xavi.
> -----Mensaje original-----
> De: [email protected] [mailto:[email protected]] En
> nombre de Thomas K. Rosin
> Enviado el: dimecres, 21 / gener / 2009 16:22
> Para: [email protected]
> Asunto: [ossec-list] Re: RV: Rule questions
>
>
> Hi Xavier,
>
> this
>
> <rule id="100001" level="0">
>
> means, ignore and take no action. Please try "level > 0, maybe 3.
>
> Have a look there:
> http://www.ossec.net/wiki/index.php/Know_How:Rules_Severity
>
> By, Thomas.
>
> Xavier Romero schrieb:
> > Hello all,
> >
> > I just want this default rule:
> >
> > <group name="pam,syslog,">
> > ...
> > <rule id="5501" level="3">
> > <if_sid>5500</if_sid>
> > <match>session opened for user </match>
> > <description>Login session opened.</description>
> > <group>authentication_success,</group>
> > </rule>
> > ...
> > </group>
> >
> > to avoid alerts for CRON executions like:
> > => CRON[23946]: (pam_unix) session opened for user root by (uid=0)
> >
> > I've tried
> >
> > <rule id="100001" level="0">
> > <if_sid>5501, 5502</if_sid>
> > <match>CRON</match>
> > <description>Ignored</description>
> > </rule>
> >
> > and
> >
> > <rule id="100001" level="0">
> > <if_sid>5500</if_sid>
> > <match>CRON</match>
> > <match>session opened for user </match>
> > <description>Ignored</description>
> > </rule>
> >
> > and
> >
> > <rule id="100001" level="0">
> > <if_sid>5500</if_sid>
> > <match>CRON</match>
> > <description>Ignored</description>
> > </rule>
> >
> > But none of these produces the desired effect.
> >
> > Which is the right way to achieve that?
> > When there are no more rules executed? First match? Lower level? ...?
> > What happens when tehre are 2 <match> or 2 <url>.. that acts as OR or
> as AND ?!?
> > <group> have any implication on rules or it's just for logical
> classification?
> >
> >
> > Thanks in advance!
> > Xavier Romero.
>
>
>
> --
> Chirado OHG
> Thomas K. Rosin
>
> Telefon: 02181 2156701
> Telefax: 02181 2156708
> E-Mail: [email protected]
>
> GnuPG-/PGP-Schlüssel auf Anfrage
>
> -----------------------------------
> Informationen zum Unternehmen:
> Chirado OHG
> Unterstraße 61
> 41516 Grevenbroich
>
> Geschäftsführende Gesellschafter:
> Alexander Hoff, Thomas K. Rosin
>
> Sitz: Grevenbroich
> Gerichtsstand: Mönchengladbach
> Handelsregistereintrag: HRA 4940
>
> USt.-IdNr.: DE215386270
