On Wed, Oct 27, 2010 at 1:44 PM, Steven Stern <[email protected]> wrote: > In /var/ossec/etc/osse.conf, I have > > <command> > <name>firewall-drop</name> > <executable>firewall-drop.sh</executable> > <expect>srcip</expect> > <timeout_allowed>yes</timeout_allowed> > </command> > > <active-response> > <command>firewall-drop</command> > <location>local</location> > <rules_id>31151</rules_id> > <level>8</level> > </active-response> > > My logs show multiple 31151 alerts. For example: > ossec-alerts-23.log:Rule: 31151 (level 10) -> 'Mutiple web server 400 > error codes from same source ip.' > ossec-alerts-25.log:Rule: 31151 (level 10) -> 'Mutiple web server 400 > error codes from same source ip.' > > As far as I can tell, the active response has never been triggered. > There's no active-response log in /var/ossec/logs and no logging of > firewall changes. > > What am I missing? >
I don't know if that rule will push the srcip (I haven't tried it, and can't test it at the moment). Test your config out with another rule to see if the it's correct. I also don't think you'll need the <level> option as well as <rules_id>, you could try it without that also..
