There is no srcip decoded in the log message (and no IP at all). Remove that line and it should work.
On Tue, Oct 26, 2010 at 9:25 AM, Mike Sievers <[email protected]> wrote: > Hi List, > > for example: (server1=agent) > > OSSEC HIDS Notification. > 2010 Oct 26 15:06:00 > > Received From: (server1) 192.168.224.49->/var/log/messages > Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system." > Portion of the log(s): > > Oct 26 15:06:26 server1 libvirtd: 15:06:26.774: error : virLibConnError:441 > : this function is not supported by the hypervisor: > virConnectNumOfInterfaces > > --END OF NOTIFICATION > > local config at the manager: > > <rule id="100106" level="0"> > <if_sid>1002</if_sid> > <match>virLibConnError:441</match> > <srcip>192.168.224.49</srcip> > <description>Ignoring</description> > </rule> > > What is wrong? > > Mike >
