Question

I have the standard syslog_rules.xml (OSSEC 2.6.0). This is the standard rule for bad words in the /var/log/messages file:

<var name="BAD_WORDS">core_dumped|failure|error|attack|bad |illegal |denied|refused|unauthorized|fatal|failed|Segmentation Fault|Corrupted</var>
.....    
<rule id="1002" level="2">
<match>$BAD_WORDS</match>
<options>alert_by_email</options>
<description>Unknown problem somewhere in the system.</description>
</rule>
.....

How can I add or modify this rule that uses $BAD_WORDS, but excludes the auxpropfunc error phrase? That is, something like this:

<match>$BAD_WORDS</match>
<match>!auxpropfunc error</match>
<options>alert_by_email</options>

Any ideas?

No correct solution

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top