[ossec-dev] Suggested addition to default shipping syslog rules

["Jess Bromley" <j.bromley@xxxxxxxxxxxxx>]

Quick suggestion.  The useradd that ships with SuSE linux sends:

... useradd[123456]: new account added ...

instead of "new user".  It might be a good idea to add a regex for this to  
rule 5902 in the default shipping syslog_rules.xml.  (I know how to do  
this myself, but it seems to me important enough that it should be done  
already in the default install...)

Similarly SuSE reports "account deleted" rather than "user deleted".

I'm not on the list so email me direct if you would like any further info.

J Bromley