What is the best way to get an alert for a particular event in the Apache logs? Let's say I want to get e-mail alerts for "Pattern match"...and all data included in that event, is that possible? If so, how? For example, lets say I get an alert in my httpd_err.log that looks like this: [Sun Sep 27 23:58:07 2009] [error] [client 126.10.10.1] ModSecurity: Warning. Pattern match "(?:"\\s*\\*.+(?:or|id)\\W*"\\d)|(?:\\^")|(?:^[\\w\\s"-]+(?<=and\\s)(?<=or\\s)(?<=xor\\s)(?<=nand\\s)(?<=not\\s)(?<=\\|\\|)(?<=\\&\\&)\\w+\\()|(?:"[\\s\\d]*[^\\w\\s]+\\W*\\d\\W*.*["\\d])|(?:"\\s*[^\\w\\s?]+\\s*[^\\w\\s]+\\s*")|(?:"\\s*[^\\w\\s]+\\s*[\\W\\d].*(?:#|--))|(?:".*\\*\\s*\\d)|(?:"\\s*o ..." at REQUEST_URI_RAW. [file "/system/webfam/apache/conf.d/modsecurity/base_rules/modsecurity_crs_31_ids.psv.conf"] [line "109"] [id "phpids-43"] [msg "Detects classic SQL injection probings 2/2"] [tag "WEB_ATTACK"] [hostname "server-webfarm-1"] [uri "/buy/Pizza"] [unique_id "SsBefwoBBG8AAF2PGwYAAABc"]
How could I get alerts for this with Ossec?
