/var/ossec/rules/local_rules.xml I apologize for not mentioning this earlier.
On Thu, May 3, 2012 at 10:52 AM, A-Dubbs <[email protected]> wrote: > In which file would I create level 0 rules at your prescribe wouldn't > trigger alerts and wouldn't be log anything in alerts.log? In Dan > (ddp)'s first reply in this thread, he advised me ( I'm brand new to > OSSEC but really trying here!!!) to not modify the msauth_rules.xml > file. I pretty much understand why after he explained why I shouldn't, > but I don't see any other place but the msauth_rules.xml file to lower > the level on some of these low-to-mid level alerts on the file so they > won't trigger alerts in alerts.log file. For example, when a windows > workstation's system account logs onto the domain controller, > WINDOWS_LOGIN_SUCCESS, or a user logon on, AUDIT_SUCCESS), I don't > think should see OSSEC triggering an alert on my system. > > > > On May 3, 8:09 am, Florian Crouzat <[email protected]> wrote: >> Le 02/05/2012 20:10, A-Dubbs a écrit : >> >> > Will it at least significantly reduce the amount of alerts in the >> > alerts.log file? I just want to verify I am modifying the correct >> > settings for reducing alerts. >> >> It will, yes, except for ... exceptions ;) >> >> If don't have enough disk space to store the alerts.log history, you can >> just delete the files. Basically, you are storing them twice already, >> /var/ossec/logs/archives vs. /var/ossec/logs/alerts. >> >> You want to store raw received logs (archives). Alerts logs are just >> decoded archives and at least five times bigger (multi-lines for a >> single raw log line). >> In case you need to understand how a certain received log-line has been >> treated, you still can re-decode it from archives.log using >> ossec-logtest, but certainly, you never will. >> >> Finally, to reduce the alerts.log file, if you are using ossec just to >> centralize and store certain logs, create as many level 0 rules as >> possible for these logs, they still will be stored, but never decoded: >> they won't trigger alerts and won't be logged in alerts.log) >> >> Hope it helps. >> >> -- >> Cheers, >> Florian Crouzat
