ddp wrote:
> Create local rules that match on the entries you want to ignore and
> set them to a low level (level="0"). You may need to include
> "<if_sid>1002</if_sid>" in some of these rules to get them to work
> instead of ossec firing 1002 alerts off instead.
> dan
>
>
Ok, I created a local rule in syslog_rules.xml.
The regex is:
\[horde\] Error retrieving session data \(id = [a-f0-9]+\): Lock wait
timeout exceeded; try restarting transaction
for logentries like:
Apr 25 10:33:40 servername HORDE[14046]: [horde] Error retrieving
session data (id = 97c2565csadf126asdf9deacd): Lock wait timeout
exceeded; try restarting transaction [pid 14046 on line 144 of
"/dir/to/horde/lib/Horde/SessionHandler/mysql.php"]
I checked the regex with an regex online checker and the expression
should match this entry. But my rule still didn't fire instead of the
"Unknown problem somewhere in the system." id 1002. I put my local rule
in the same group with the 1002 rule and it looks like:
<rule id="500" level="10">
<match>\[horde\] Error retrieving session data \(id = [a-f0-9]+\):
Lock wait timeout exceeded; try restarting transaction</match>
<options>alert_by_email</options>
<description>TEST</description>
</rule>
But it doesn't fire. Any ideas?
Thanks in advance
--
Andre Pawlowski
-------------------------------------------------------------------
Warum fallen wir?
Damit wir lernen können, uns wieder aufzurappeln.
-Batman Begins (Thomas Wayne)
