Hello, Here's the event from the archives:
2009 Jun 14 08:32:39 (host.someplace) 1.2.3.4->/var/log/secure.log Jun 14 08:32:39 host su[19646]: jsmith to jsmith on /dev/ttys000 Here's the alert: ** Alert 1244993559.438554: mail - local,syslog,su,authentication_success, 2009 Jun 14 08:32:39 (host.someplace) 1.2.3.4->/var/log/secure.log Rule: 5304 (level 3) -> 'User successfully changed UID.' Src IP: (none) User: jsmith Jun 14 08:32:39 host su[19646]: jsmith to jsmith on /dev/ttys000 It's being decoded properly, since the User name has been picked up from the event. It's being decoded by su-detail2 in decoder.xml using the regex ^(\S+) to (\S+) on: <decoder name="su-detail2"> <parent>su</parent> <regex>^BAD SU (\S+) to (\S+) on|</regex> <regex>^failed: \S+ changing from (\S+) to (\S+)|</regex> <regex>^\S \S+ (\S+)\p(\S+)$|^(\S+) to (\S+) on </regex> <order>srcuser, dstuser</order> <fts>name, srcuser, location</fts> </decoder> Yet, when I look in /var/ossec/queue/fts/fts-queue there is no entry for the su event. I don't have this problem for other OS' (e.g. Solaris, RHE, SuSE) all of which use a different decoder. Any ideas?
