[ossec-dev] Re: Suggested addition to default shipping syslog rules

["Daniel Cid" <dcid@xxxxxxxxx>]

Hi Jess,

Great suggestion. I just added them to CVS. Btw, do you have a few
log samples of these messages to share? Just to do a quick testing..

Thanks,

--
Daniel B. Cid
dcid ( at ) ossec.net

On 9/15/06, Jess Bromley <j.bromley@xxxxxxxxxxxxx> wrote:
> Quick suggestion.  The useradd that ships with SuSE linux sends:
>
> ... useradd[123456]: new account added ...
>
> instead of "new user".  It might be a good idea to add a regex for this to
> rule 5902 in the default shipping syslog_rules.xml.  (I know how to do
> this myself, but it seems to me important enough that it should be done
> already in the default install...)
>
> Similarly SuSE reports "account deleted" rather than "user deleted".
>
> I'm not on the list so email me direct if you would like any further info.
>
> J Bromley