here you go.
<group name="local">
<rule id="100101" level="0">
<if_level>3</if_level>
<srcip>75.36.241.42</srcip>
<description>Ignoring ip 75.36.241.42</description>
</rule>
<!-- We need to use "match" if the IP is not being decoded -->
<rule id="100102" level="0">
<if_level>3</if_level>
<match>75.36.241.42</match>
<description>Ignoring ip 75.36.241.42</description>
</rule>
</group>
----- Original Message -----
From: "dan (ddp)" <[email protected]>
To: <[email protected]>
Sent: Monday, February 07, 2011 9:37 AM
Subject: Re: [ossec-list] unable to get ossec to ggnore the error from this
ip - please help
Show us the rule you put in. Show us the log message.
On Sun, Feb 6, 2011 at 8:22 AM, jeff jennings
<[email protected]> wrote:
I have been unable to get ossec to ignore this particular error from this
particular IP address even though I've added an ignore rule in
local_rules.xml and restarted ossec
I've follow the manuals description of how to write an ignore rukle to no
avail - so how would you guys go about it>
thanks - jeff
here's the error I want to ignore:
Received From: (mysite-on-42)
75.36.241.42->/usr/local/website-logs/mysite_access_02042011.log
Rule: 31151 fired (level 10) -> "Mutiple web server 400 error codes from
same source ip."
Portion of the log(s):
blah, blah, blah....
