For some reason rule 1003 "Non standard syslog message (size too large)" is firing for many of the log entries I receive from an Windows agent that's sending IIS logs. Obviously the log entry is rather long, but why is OSSEC complaining about this entry? This doesn't seem to be behaving as designed. Here's an example alert:
OSSEC HIDS Notification. 2009 May 08 00:38:11 Received From: (WEB2A.gdsxprod.com) 72.249.xxx.xxx->\inetpub\logs\LogFiles\W3SVC9\u_ex090508.log Rule: 1003 fired (level 13) -> "Non standard syslog message (size too large)." Portion of the log(s): 2009-05-08 05:37:51 72.249.xxx.xxx GET /Publish.aspx ED=Df7H1kfWkUvDX%2fkMT9BGcfsmwA1vRFezk8qDnnV%2bSv%2bhVlx96DXpt3RGKG2EOyu i8C4JobaciCOl8DOuqHY4u5KeyXGNfdrTd7CLBe7cWtSC60W9%2f55DHK2DE3R8W1fX9%2ft XNmLOfLRWMqkB9kZRXntGWyP4YGPQLjxwzKYMjK5ZTOqTj8AsSXkHuPnyoAgRqZH7rOFKwLq uEU7bNdTdgqIMark5NgxfUiwqqpktN4eMWkp2jRsAOUb4QHTcJnexRon11HnbtZVYz4FrPN7 9ZcIiaAtKwRP%2b50tEEn6ThvsN8Qj9r8XCyZWdzL3qy89htpjhcYOoMPcmb%2boSetam1vQ Uv4uWYabK83YhnG7fE6JhMsD4fL3JE6t2WD2ZEAzNeddtcwfnYot7SjmeqPWJEceg6C4Aqfg u%2bPLhd4wr7fnANUAjW5NxhRdXClt92D6A2oXB3Ygb537j08msBjdhUdKBcxDOVuZNr9ZVM NwFrtxBDq5o9kY88QLENyiERvY5IZD3qmwNMWnLlQI5oZt7Sh2K2HfGjPbNJzCaMurHMmL9k nX2ipcrbjDXQuxqkKX8qAcDGMksqTQs9ITBE2pnPQZ9mzbIYcK6qOzSN9WFGBwLQiwina9vE H483VXxhDVr%2bjgPOi9hqM6XU2uDHKpM8Zn4jd6x0V7D1Fc00TTJoyHoQeNlNl2eQVG2FkI itTCM 443 - 208.4.xxx.xxx Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+2.0.507 27;+.NET+CLR+3.0.4506.2152;+.NET+CLR+3.5.30729;+.NET+CLR+1.1.4322) 302 0 0 3744 --END OF NOTIFICATION Chris Kolb Manager of Information Security GDSX, Ltd. Phone: 972-612-7121 Fax: 972-612-7021 Confidentiality Notice: This e-mail contains information that is confidential. It is intended for the exclusive use of the individual or entity to whom it is addressed. If you are not the named recipient, disclosure or distribution of the information transmitted herewith is strictly prohibited and may be subject to legal restriction or sanction. Please notify the sender, by return e-mail or telephone, of any unintended recipients and delete the original message without making any copies.
