Whenever my rule triggers, I get three alerts sent to the OSSEC server. I am not sure what is causing it to do that. There is only one log entry being entered into the "messages" file. Any ideas?
The rule looks like this: <group name="local,syslog,"> <rule id="100000" level="0"> <decoded_as>PPTP</decoded_as> <description>PPTP messages grouped.</description> </rule> <rule id="100001" level="14"> <if_sid>100000</if_sid> <match>finished</match> <description>Finished PPTP connection.</description> </rule> <rule id="100002" level="14"> <if_sid>100000</if_sid> <match>started</match> <description>Started PPTP connection.</description> </rule> </group> var/log/messages on host with ossec agent: Dec 10 05:52:18 system pptpd[32115]: CTRL: Client 192.168.2.212 control connection finished /var/ossec/logs/alerts on ossec server Dec 10 05:52:18 system pptpd[32115]: CTRL: Client 192.168.2.212 control connection finished User: (none) Src IP: 192.168.2.212 Rule: 100001 (level 14) -> 'Finished PPTP connection.' 2011 Dec 09 23:51:46 (system) 192.168.2.1->/var/log/messages ** Alert 1323492706.1096851: mail - local,syslog, Dec 10 05:52:18 system pptpd[32115]: CTRL: Client 192.168.2.212 control connection finished User: (none) Src IP: 192.168.2.212 Rule: 100001 (level 14) -> 'Finished PPTP connection.' 2011 Dec 09 23:51:46 (system) 192.168.2.1->/var/log/messages ** Alert 1323492706.1096555: mail - local,syslog, Dec 10 05:52:18 system pptpd[32115]: CTRL: Client 192.168.2.212 control connection finished User: (none) Src IP: 192.168.2.212 Rule: 100001 (level 14) -> 'Finished PPTP connection.' 2011 Dec 09 23:51:46 (system) 192.168.2.1->/var/log/messages ** Alert 1323492706.1096259: mail - local,syslog, Thanks!
