Hey Chris, It looks like you're missing some fields in your logs. OSSEC decodes IIS logs based on w3c extended or NCSA. Check this link for IIS configuration details:
http://www.ossec.net/main/manual/manual-log-analysis/#iis cheers, cnk On Tue, May 12, 2009 at 2:43 PM, Chris Kolb <[email protected]> wrote: > For some reason rule 1003 "Non standard syslog message (size too large)” is > firing for many of the log entries I receive from an Windows agent that’s > sending IIS logs. Obviously the log entry is rather long, but why is OSSEC > complaining about this entry? This doesn’t seem to be behaving as > designed. Here’s an example alert: > > > > OSSEC HIDS Notification. > > 2009 May 08 00:38:11 > > > > Received From: (WEB2A.gdsxprod.com) > 72.249.xxx.xxx->\inetpub\logs\LogFiles\W3SVC9\u_ex090508.log > > Rule: 1003 fired (level 13) -> "Non standard syslog message (size too > large)." > > Portion of the log(s): > > > > 2009-05-08 05:37:51 72.249.xxx.xxx GET /Publish.aspx > ED=Df7H1kfWkUvDX%2fkMT9BGcfsmwA1vRFezk8qDnnV%2bSv%2bhVlx96DXpt3RGKG2EOyui8C4JobaciCOl8DOuqHY4u5KeyXGNfdrTd7CLBe7cWtSC60W9%2f55DHK2DE3R8W1fX9%2ftXNmLOfLRWMqkB9kZRXntGWyP4YGPQLjxwzKYMjK5ZTOqTj8AsSXkHuPnyoAgRqZH7rOFKwLquEU7bNdTdgqIMark5NgxfUiwqqpktN4eMWkp2jRsAOUb4QHTcJnexRon11HnbtZVYz4FrPN79ZcIiaAtKwRP%2b50tEEn6ThvsN8Qj9r8XCyZWdzL3qy89htpjhcYOoMPcmb%2boSetam1vQUv4uWYabK83YhnG7fE6JhMsD4fL3JE6t2WD2ZEAzNeddtcwfnYot7SjmeqPWJEceg6C4Aqfgu%2bPLhd4wr7fnANUAjW5NxhRdXClt92D6A2oXB3Ygb537j08msBjdhUdKBcxDOVuZNr9ZVMNwFrtxBDq5o9kY88QLENyiERvY5IZD3qmwNMWnLlQI5oZt7Sh2K2HfGjPbNJzCaMurHMmL9knX2ipcrbjDXQuxqkKX8qAcDGMksqTQs9ITBE2pnPQZ9mzbIYcK6qOzSN9WFGBwLQiwina9vEH483VXxhDVr%2bjgPOi9hqM6XU2uDHKpM8Zn4jd6x0V7D1Fc00TTJoyHoQeNlNl2eQVG2FkIitTCM > 443 - 208.4.xxx.xxx > Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.4506.2152;+.NET+CLR+3.5.30729;+.NET+CLR+1.1.4322) > 302 0 0 3744 > > > > > > > > --END OF NOTIFICATION > > > > > > > > Chris Kolb > Manager of Information Security > > GDSX, Ltd. > Phone: 972-612-7121 > Fax: 972-612-7021 > > > > Confidentiality Notice: This e-mail contains information that is > confidential. It is intended for the exclusive use of the individual or > entity to whom it is addressed. If you are not the named recipient, > disclosure or distribution of the information transmitted herewith is > strictly prohibited and may be subject to legal restriction or sanction. > Please notify the sender, by return e-mail or telephone, of any unintended > recipients and delete the original message without making any copies. > >
