I definitely get a segfault though and I clear out my local rules. There was
nothing in there execpt of this group with one rule.
Is it an Ubuntu problem then?
this is my "original" rule in apache_rules.xml :
80 <rule id="30109" level="9">
81 <if_sid>30101</if_sid>
82 <regex>user \S+ not found</regex>
83 <description>Attempt to login using a non-existent user.</description>
84 <group>invalid_login,</group>
85 </rule>
and this is the strace I get, when I am testing the log entry with
ossec-logtest:
[Mon Jan 23 08:40:46 2012] [error] [client 192.168.0.123] user unknownUser not
found: /myapp/
"[Mon Jan 23 08:40:46 2012] [erro"..., 1024) = 94
write(2, "\n", 1
) = 1
write(2, "\n", 1
) = 1
stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=2309, ...}) = 0
write(2, "**Phase 1: Completed pre-decodin"..., 34**Phase 1: Completed
pre-decoding.) = 34
write(2, "\n", 1
) = 1
write(2, " full event: '[Mon Jan 23 "..., 114 full event: '[Mon Jan
23 08:40:46 2012] [error] [client 192.168.0.123] user unknownUser not found:
/myapp/') = 114
write(2, "\n", 1
) = 1
write(2, " hostname: 'server'", 23 hostname: 'server') = 23
write(2, "\n", 1
) = 1
write(2, " program_name: '(null)'", 29 program_name: '(null)') = 29
write(2, "\n", 1
) = 1
write(2, " log: '[error] [client 192"..., 80 log: '[error] [client
192.168.0.123] user unknownUser not found: /myapp/') = 80
write(2, "\n", 1
) = 1
write(2, "\n**Phase 2: Completed decoding.", 31
**Phase 2: Completed decoding.) = 31
write(2, "\n", 1
) = 1
write(2, " decoder: 'apache-errorlog"..., 33 decoder:
'apache-errorlog') = 33
write(2, "\n", 1
) = 1
write(2, " srcip: '192.168.0.123'", 29 srcip: '192.168.0.123') = 29
write(2, "\n", 1
) = 1
--- SIGSEGV (Segmentation fault) @ 0 (0) ---
+++ killed by SIGSEGV +++
Segmentation fault
On 03.02.2012, at 18:32, Andreas Piesk wrote:
> On 03.02.2012 16:09, Oliver Müller wrote:
>> You have to past in this as ONE line (ends with /myapp/):
>>
>> [Mon Jan 23 08:40:46 2012] [error] [client 192.168.0.123] user unknownUser
>> not found: /myapp/
>>
>
> that's what i did. testing the above line uo to /myapp/ doesn't produce a
> segfault on my system.
>
> regards,
> -ap
