On Mon, Dec 3, 2012 at 2:13 PM, Daniel Requena <[email protected]> wrote: > Hi, > > I'm trying to customize the behavior of the rule 35051 > (squid_rules.xml) in order to not have it fired if someone tries to access > facebook website. > This rule keeps annoying me, because Facebook "like" button is > EVERYWHERE and my proxy server blocks it. > I wrote this piece of rule on my local_rules.xml but with no success. > > <rule id="100060" level="0"> > <if_sid>35051</if_sid> > <match>.facebook.com/</match> > <description>Squid cache report</description> > </rule> > > Does anybody have the same problem? I'm I doing something wrong? > I appreciate any help. > > Regards. >
Can you provide a log sample? > ps: I'm using Ossec Server v2.5.1 Upgrade.
