Dan, Thanks, that's what I thought based on the key/value references in the documentation.
Sent from my iPhone On Dec 12, 2011, at 3:08 PM, "dan (ddp)" <[email protected]> wrote: > On Sat, Dec 10, 2011 at 12:01 AM, vmpc vmpc <[email protected]> wrote: >> Whenever my rule triggers, I get three alerts sent to the OSSEC server. I am >> not sure what is causing it to do that. There is only one log entry being >> entered into the "messages" file. Any ideas? >> >> The rule looks like this: >> >> <group name="local,syslog,"> >> <rule id="100000" level="0"> >> <decoded_as>PPTP</decoded_as> >> <description>PPTP messages grouped.</description> >> </rule> >> >> <rule id="100001" level="14"> >> <if_sid>100000</if_sid> >> <match>finished</match> >> <description>Finished PPTP connection.</description> >> </rule> >> >> <rule id="100002" level="14"> >> <if_sid>100000</if_sid> >> <match>started</match> >> <description>Started PPTP connection.</description> >> </rule> >> </group> >> >> >> var/log/messages on host with ossec agent: >> Dec 10 05:52:18 system pptpd[32115]: CTRL: Client 192.168.2.212 control >> connection finished >> >> /var/ossec/logs/alerts on ossec server >> Dec 10 05:52:18 system pptpd[32115]: CTRL: Client 192.168.2.212 control >> connection finished >> User: (none) >> Src IP: 192.168.2.212 >> Rule: 100001 (level 14) -> 'Finished PPTP connection.' >> 2011 Dec 09 23:51:46 (system) 192.168.2.1->/var/log/messages >> ** Alert 1323492706.1096851: mail - local,syslog, >> >> Dec 10 05:52:18 system pptpd[32115]: CTRL: Client 192.168.2.212 control >> connection finished >> User: (none) >> Src IP: 192.168.2.212 >> Rule: 100001 (level 14) -> 'Finished PPTP connection.' >> 2011 Dec 09 23:51:46 (system) 192.168.2.1->/var/log/messages >> ** Alert 1323492706.1096555: mail - local,syslog, >> >> Dec 10 05:52:18 system pptpd[32115]: CTRL: Client 192.168.2.212 control >> connection finished >> User: (none) >> Src IP: 192.168.2.212 >> Rule: 100001 (level 14) -> 'Finished PPTP connection.' >> 2011 Dec 09 23:51:46 (system) 192.168.2.1->/var/log/messages >> ** Alert 1323492706.1096259: mail - local,syslog, >> >> Thanks! >> > > Is /var/log/messages entered twice into the ossec.conf/agent.conf? Are > the messages duplicated in /var/log/messages?
