Luciano Mannucci napsal(a):
> Hello,
>
> I need to kill the log analisys of my squid server, because it sends
> an alert when a non-existent file is requested multiple times (wich is
> NOT an issue), revealing the file name (the URL, realy) AND the IP
> address of the requestor, which is illegal here in Italy, for it may
> "shaow user sexual preferences or habits" and we are not allowed to
> monitor that.
> So I see three ways to achieve that:
>
> 1 - move the squid log away, in a way that ossec can't detect it
>
> 2 - remove the ossec agent from the squid machine.
>
> 3 - fix the ossec configuration.
>
> The first two options are quick and dirty but not elegant.
> Is there anyone that can help me implementing option 3?
>
you can disable particular rule. look for reported rule number, place it
in rule_id attribute here:
<rule id="REPORTED RULE ID HERE" level="0" overwrite="yes">
<description>Your description here</description>
</rule>
and add rule you created to your local rules.
> Cheers to everybody,
>
> luciano.
>
--
Martin Tomasek
