On Mon, Feb 7, 2011 at 10:36 AM, jjennings <[email protected]> wrote:
> here you go.
>
> <group name="local">
> <rule id="100101" level="0">
> <if_level>3</if_level>
> <srcip>75.36.241.42</srcip>
> <description>Ignoring ip 75.36.241.42</description>
> </rule>
>
> <!-- We need to use "match" if the IP is not being decoded -->
> <rule id="100102" level="0">
> <if_level>3</if_level>
> <match>75.36.241.42</match>
> <description>Ignoring ip 75.36.241.42</description>
> </rule>
> </group>
>
Works for me:
# /var/ossec/bin/ossec-logtest -D . -c etc/ossec.conf
2011/02/07 10:52:17 ossec-testrule: INFO: Reading local decoder file.
2011/02/07 10:52:18 ossec-testrule: INFO: Started (pid: 15264).
ossec-testrule: Type one log per line.
Jun 9 00:00:01 ix sshd[8813]: Accepted password for root from
75.36.241.42 port 1066 ssh2
**Phase 1: Completed pre-decoding.
full event: 'Jun 9 00:00:01 ix sshd[8813]: Accepted password
for root from 75.36.241.42 port 1066 ssh2'
hostname: 'ix'
program_name: 'sshd'
log: 'Accepted password for root from 75.36.241.42 port 1066 ssh2'
**Phase 2: Completed decoding.
decoder: 'sshd'
dstuser: 'root'
srcip: '75.36.241.42'
**Phase 3: Completed filtering (rules).
Rule id: '100102'
Level: '0'
Description: 'Ignoring ip 75.36.241.42'
>
>
>
> ----- Original Message ----- From: "dan (ddp)" <[email protected]>
> To: <[email protected]>
> Sent: Monday, February 07, 2011 9:37 AM
> Subject: Re: [ossec-list] unable to get ossec to ggnore the error from this
> ip - please help
>
>
>> Show us the rule you put in. Show us the log message.
>>
>> On Sun, Feb 6, 2011 at 8:22 AM, jeff jennings
>> <[email protected]> wrote:
>>>
>>> I have been unable to get ossec to ignore this particular error from this
>>> particular IP address even though I've added an ignore rule in
>>> local_rules.xml and restarted ossec
>>>
>>> I've follow the manuals description of how to write an ignore rukle to no
>>> avail - so how would you guys go about it>
>>>
>>> thanks - jeff
>>>
>>> here's the error I want to ignore:
>>>
>>> Received From: (mysite-on-42)
>>> 75.36.241.42->/usr/local/website-logs/mysite_access_02042011.log
>>> Rule: 31151 fired (level 10) -> "Mutiple web server 400 error codes from
>>> same source ip."
>>> Portion of the log(s):
>>>
>>> blah, blah, blah....
>>>
>>>
>>
>
>
