----- Original Message ----- > On Tue, Feb 8, 2011 at 2:10 PM, --[ UxBoD ]-- <[email protected]> > wrote: > > > > <SNIP> > > > > Okay have been doing quite a bit of testing with all this; and now > > I am checking the *correct* rule to start with am seeing some > > interesting results. Here are the two rules defined in > > local_rules.xml: > > > > <rule id="10044" level="1"> > > <if_sid>5551</if_sid> > > <description>Multiple SSHD authentication failures (Override > > Generic)</description> > > <group>authentication_failures,</group> > > </rule> > > > > <rule id="10061" level="10" frequency="3" timeframe="180"> > > <if_matched_sid>10044</if_matched_sid> > > <same_source_ip /> > > <description>Multiple SSHD authentication failures - GLPI > > #493</description> > > <group>authentication_failures,</group> > > </rule> > > > > I start by testing with a source file that contains 31 lines of > > failed password attempts all happening within 3 minutes: > > > > Feb 8 13:05:27 someuser sshd[28052]: pam_unix(sshd:auth): > > authentication failure; logname= uid=0 euid=0 tty=ssh ruser= > > rhost=123.123.123.123 user=someuser > > <SNIP> > > > I run that through ossec-logtest and check for how many times rule > > 5503 hits: > > > > grep -c "Rule 5503 matched" result > > 31 > > > > That is correct. Now rule 5551 is a standard rule as-well in the > > pam file and is written as: > > > > <rule id="5551" level="10" frequency="6" timeframe="180"> > > <if_matched_sid>5503</if_matched_sid> > > <same_source_ip /> > > <description>Multiple failed logins in a small period of > > time.</description> > > <group>authentication_failures,</group> > > </rule> > > > > Yet if I check how many times that hits, and I would expect 5 times > > but I only see: > > > > grep -c "Rule 5551 matched" result > > 3 > > > > I must be missing something really simple here ???? > > > > Thanks, Phil > > > > > > > > > > Doesn't look like you're missing anything. >
Why so Dan ? If the frequency on rule 5551 is 6, and there are 31 events that trigger rule 5503, then I would have expected rule 5551 to have matched 6 times when in fact it only matched 3 times ?
