On Mon, Jun 10, 2013 at 3:58 AM, Jeroen Beerstra <[email protected]> wrote: > The problem is my e-mail gets flooded by certain syslog errors, so I wrote a > custom rule to ignore these errors: > > <rule id="100001" level="0"> > <if_sid>1002</if_sid> > <match>MATCH</match> > <description>Ignore syslog errors</description> > </rule> >
We generally recommend not doing this, and instead creating rules to handle the log messages triggering the 1002s. > The funky thing is, ossec-logtest works as expected. That is: if I feed it a > line from syslog with MATCH in it, it fires rule 100001. However I still get > lots of e-mails for MATCH and rule 1002. Why is this? As of now ossec is > rendered useless because I receive way to much false positives. > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/groups/opt_out. > > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
