Try it without the match line.
On Wed, Jun 2, 2010 at 2:34 AM, [email protected] <[email protected]> wrote: > Hi All, > > My ignore rule doesn't seem to be catching the rule at the end of this > email. > > <rule id="100014" level="0"> > <if_sid>11307</if_sid> > <match>mirage pure-ftpd:</match> > <description>Ignore this rule for multiple new connections to > ftp.netspace</description> > </rule> > > Have I got it right??? I've restarted both agent and server but keep > getting alerts about it. > > -----Original Message----- > From: OSSEC HIDS [mailto:[email protected]] > Sent: Wednesday, 2 June 2010 4:29 PM > To: Andy > Subject: OSSEC Notification - (ftp.netspace) 203.10.110.104 - Alert > level 10 > > OSSEC HIDS Notification. > 2010 Jun 02 16:29:06 > > Received From: (ftp.netspace) 203.10.110.104->/var/log/xferlog > Rule: 11307 fired (level 10) -> "Multiple connection attempts from > same source." > Portion of the log(s): > > Jun 2 16:30:39 mirage pure-ftpd: (? > @220-253-26-53.VIC.netspace.net.au) [INFO] New connection from > 220-253-26-53.VIC.netspace.net.au Jun 2 16:30:37 mirage pure-ftpd: (? > @220-253-26-53.VIC.netspace.net.au) [INFO] New connection from > 220-253-26-53.VIC.netspace.net.au Jun 2 16:30:36 mirage pure-ftpd: (? > @220-253-26-53.VIC.netspace.net.au) [INFO] New connection from > 220-253-26-53.VIC.netspace.net.au Jun 2 16:30:36 mirage pure-ftpd: (? > @220-253-26-53.VIC.netspace.net.au) [INFO] New connection from > 220-253-26-53.VIC.netspace.net.au Jun 2 16:30:32 mirage pure-ftpd: (? > @220-253-26-53.VIC.netspace.net.au) [INFO] New connection from > 220-253-26-53.VIC.netspace.net.au Jun 2 16:30:31 mirage pure-ftpd: (? > @220-253-26-53.VIC.netspace.net.au) [INFO] New connection from > 220-253-26-53.VIC.netspace.net.au Jun 2 16:30:30 mirage pure-ftpd: (? > @220-253-26-53.VIC.netspace.net.au) [INFO] New connection from > 220-253-26-53.VIC.netspace.net.au > > <rule id="100014" level="0"> > <if_sid>11307</if_sid> > <match>mirage pure-ftpd:</match> > <description>Ignore this rule for multiple new connections to > ftp.netspace</description> > </rule> > > Thanks. > > Andy > >
