On Sat, Dec 10, 2011 at 12:01 AM, vmpc vmpc <[email protected]> wrote: > Whenever my rule triggers, I get three alerts sent to the OSSEC server. I am > not sure what is causing it to do that. There is only one log entry being > entered into the "messages" file. Any ideas? > > The rule looks like this: > > <group name="local,syslog,"> > <rule id="100000" level="0"> > <decoded_as>PPTP</decoded_as> > <description>PPTP messages grouped.</description> > </rule> > > <rule id="100001" level="14"> > <if_sid>100000</if_sid> > <match>finished</match> > <description>Finished PPTP connection.</description> > </rule> > > <rule id="100002" level="14"> > <if_sid>100000</if_sid> > <match>started</match> > <description>Started PPTP connection.</description> > </rule> > </group> > > > var/log/messages on host with ossec agent: > Dec 10 05:52:18 system pptpd[32115]: CTRL: Client 192.168.2.212 control > connection finished > > /var/ossec/logs/alerts on ossec server > Dec 10 05:52:18 system pptpd[32115]: CTRL: Client 192.168.2.212 control > connection finished > User: (none) > Src IP: 192.168.2.212 > Rule: 100001 (level 14) -> 'Finished PPTP connection.' > 2011 Dec 09 23:51:46 (system) 192.168.2.1->/var/log/messages > ** Alert 1323492706.1096851: mail - local,syslog, > > Dec 10 05:52:18 system pptpd[32115]: CTRL: Client 192.168.2.212 control > connection finished > User: (none) > Src IP: 192.168.2.212 > Rule: 100001 (level 14) -> 'Finished PPTP connection.' > 2011 Dec 09 23:51:46 (system) 192.168.2.1->/var/log/messages > ** Alert 1323492706.1096555: mail - local,syslog, > > Dec 10 05:52:18 system pptpd[32115]: CTRL: Client 192.168.2.212 control > connection finished > User: (none) > Src IP: 192.168.2.212 > Rule: 100001 (level 14) -> 'Finished PPTP connection.' > 2011 Dec 09 23:51:46 (system) 192.168.2.1->/var/log/messages > ** Alert 1323492706.1096259: mail - local,syslog, > > Thanks! >
Is /var/log/messages entered twice into the ossec.conf/agent.conf? Are the messages duplicated in /var/log/messages?
