In which file would I create level 0 rules at your prescribe wouldn't trigger alerts and wouldn't be log anything in alerts.log? In Dan (ddp)'s first reply in this thread, he advised me ( I'm brand new to OSSEC but really trying here!!!) to not modify the msauth_rules.xml file. I pretty much understand why after he explained why I shouldn't, but I don't see any other place but the msauth_rules.xml file to lower the level on some of these low-to-mid level alerts on the file so they won't trigger alerts in alerts.log file. For example, when a windows workstation's system account logs onto the domain controller, WINDOWS_LOGIN_SUCCESS, or a user logon on, AUDIT_SUCCESS), I don't think should see OSSEC triggering an alert on my system.
On May 3, 8:09 am, Florian Crouzat <[email protected]> wrote: > Le 02/05/2012 20:10, A-Dubbs a écrit : > > > Will it at least significantly reduce the amount of alerts in the > > alerts.log file? I just want to verify I am modifying the correct > > settings for reducing alerts. > > It will, yes, except for ... exceptions ;) > > If don't have enough disk space to store the alerts.log history, you can > just delete the files. Basically, you are storing them twice already, > /var/ossec/logs/archives vs. /var/ossec/logs/alerts. > > You want to store raw received logs (archives). Alerts logs are just > decoded archives and at least five times bigger (multi-lines for a > single raw log line). > In case you need to understand how a certain received log-line has been > treated, you still can re-decode it from archives.log using > ossec-logtest, but certainly, you never will. > > Finally, to reduce the alerts.log file, if you are using ossec just to > centralize and store certain logs, create as many level 0 rules as > possible for these logs, they still will be stored, but never decoded: > they won't trigger alerts and won't be logged in alerts.log) > > Hope it helps. > > -- > Cheers, > Florian Crouzat
