The <match> tag only looks at the portion of the log line decoded as "log". In your case cron will be decoded as the program_name. This should work:
<rule id="100001" level="0"> <if_sid>5501, 5502</if_sid> <program_name>CRON</program_name> <description>Ignored</description> </rule> On Wed, Jan 21, 2009 at 10:22 AM, Thomas K. Rosin <[email protected]> wrote: > > Hi Xavier, > > this > > <rule id="100001" level="0"> > > means, ignore and take no action. Please try "level > 0, maybe 3. > > Have a look there: http://www.ossec.net/wiki/index.php/Know_How:Rules_Severity > > By, Thomas. > > Xavier Romero schrieb: >> Hello all, >> >> I just want this default rule: >> >> <group name="pam,syslog,"> >> ... >> <rule id="5501" level="3"> >> <if_sid>5500</if_sid> >> <match>session opened for user </match> >> <description>Login session opened.</description> >> <group>authentication_success,</group> >> </rule> >> ... >> </group> >> >> to avoid alerts for CRON executions like: >> => CRON[23946]: (pam_unix) session opened for user root by (uid=0) >> >> I've tried >> >> <rule id="100001" level="0"> >> <if_sid>5501, 5502</if_sid> >> <match>CRON</match> >> <description>Ignored</description> >> </rule> >> >> and >> >> <rule id="100001" level="0"> >> <if_sid>5500</if_sid> >> <match>CRON</match> >> <match>session opened for user </match> >> <description>Ignored</description> >> </rule> >> >> and >> >> <rule id="100001" level="0"> >> <if_sid>5500</if_sid> >> <match>CRON</match> >> <description>Ignored</description> >> </rule> >> >> But none of these produces the desired effect. >> >> Which is the right way to achieve that? >> When there are no more rules executed? First match? Lower level? ...? >> What happens when tehre are 2 <match> or 2 <url>.. that acts as OR or as >> AND ?!? >> <group> have any implication on rules or it's just for logical >> classification? >> >> >> Thanks in advance! >> Xavier Romero. > > > > -- > Chirado OHG > Thomas K. Rosin > > Telefon: 02181 2156701 > Telefax: 02181 2156708 > E-Mail: [email protected] > > GnuPG-/PGP-Schlüssel auf Anfrage > > ----------------------------------- > Informationen zum Unternehmen: > Chirado OHG > Unterstraße 61 > 41516 Grevenbroich > > Geschäftsführende Gesellschafter: > Alexander Hoff, Thomas K. Rosin > > Sitz: Grevenbroich > Gerichtsstand: Mönchengladbach > Handelsregistereintrag: HRA 4940 > > USt.-IdNr.: DE215386270 > >
