The following worked for me using ossec-logtest:
<rule id="7000000" level="10">
<if_sid>1002</if_sid>
<program_name>HORDE</program_name>
<regex>Error retrieving session data \(id = \w+\): Lock wait
timeout exceeded; try restarting transaction</regex>
<description>TEST</description>
</rule>
It can probably be cleaned up a bit.
dan
On Sun, May 3, 2009 at 6:30 AM, Andre Pawlowski <[email protected]> wrote:
>
>
> ddp wrote:
>> Create local rules that match on the entries you want to ignore and
>> set them to a low level (level="0"). You may need to include
>> "<if_sid>1002</if_sid>" in some of these rules to get them to work
>> instead of ossec firing 1002 alerts off instead.
>> dan
>>
>>
> Ok, I created a local rule in syslog_rules.xml.
>
> The regex is:
> \[horde\] Error retrieving session data \(id = [a-f0-9]+\): Lock wait
> timeout exceeded; try restarting transaction
>
> for logentries like:
> Apr 25 10:33:40 servername HORDE[14046]: [horde] Error retrieving
> session data (id = 97c2565csadf126asdf9deacd): Lock wait timeout
> exceeded; try restarting transaction [pid 14046 on line 144 of
> "/dir/to/horde/lib/Horde/SessionHandler/mysql.php"]
>
> I checked the regex with an regex online checker and the expression
> should match this entry. But my rule still didn't fire instead of the
> "Unknown problem somewhere in the system." id 1002. I put my local rule
> in the same group with the 1002 rule and it looks like:
>
> <rule id="500" level="10">
> <match>\[horde\] Error retrieving session data \(id = [a-f0-9]+\):
> Lock wait timeout exceeded; try restarting transaction</match>
> <options>alert_by_email</options>
> <description>TEST</description>
> </rule>
>
> But it doesn't fire. Any ideas?
>
> Thanks in advance
>
> --
>
> Andre Pawlowski
>
> -------------------------------------------------------------------
>
> Warum fallen wir?
> Damit wir lernen können, uns wieder aufzurappeln.
> -Batman Begins (Thomas Wayne)
>
>
