On Tue, Feb 8, 2011 at 8:41 PM, upen <[email protected]> wrote: > > > On Feb 8, 7:35 pm, "dan (ddp)" <[email protected]> wrote: >> What do you have so far? > > Thanks for quick reply. > > <!-- Specify here a list of rules to ignore. --> > <!--
The '<!--' above and '-->' below indicate that this is commented out. > <rule id="100040" level="2"> > <if_sid>1002</if_sid> > <match>servername kernel: graph</match> The term "graph" did not appear in the log message at all. I don't have access to ossec at the moment, but servername is probably the hostname of the system the log message came from. If so, it won't be available to the <match> option. > <description>servername kernel: graph</description> > </rule> > --> > I really recommend running the log message through ossec-logtest. It'll give you a good amount of the information you need. > <!-- Specify here a list of rules to ignore. --> > <!-- > <rule id="100050" level="2"> > <if_sid>1002</if_sid> > <match>general protection</match> > <description>protection</description> > </rule> > --> > >
