[ossec-list] Logs from SUHOSIN - PHP Hardened

[ossec@xxxxxxxxxx]

Hi !

I've just installed SUHOSIN with my php install.

I've got some logs I'd like to submit :

Apr  1 11:44:40 localhost suhosin[24239]: ALERT - configured request
variable value length limit exceeded - dropped variable 'introtext'
(attacker '192.168.1.2', file '/var/www/site/administrator/index2.php')
Apr  1 11:47:20 localhost suhosin[23611]: ALERT - configured request
variable value length limit exceeded - dropped variable 'content'
(attacker '192.168.1.2', file '/var/www/site/index.php')
Apr  1 12:06:38 localhost suhosin[24241]: ALERT - configured request
variable value length limit exceeded - dropped variable 'introtext'
(attacker '192.168.1.2', file '/var/www/site/administrator/index2.php')
Apr  1 12:06:41 localhost suhosin[24240]: ALERT - configured request
variable value length limit exceeded - dropped variable 'content'
(attacker '192.168.1.2', file '/var/www/site/index.php')
Apr  1 12:18:01 localhost suhosin[23606]: ALERT - configured request
variable value length limit exceeded - dropped variable 'introtext'
(attacker '192.168.1.2', file '/var/www/site/administrator/index2.php')
Apr  1 12:18:26 localhost suhosin[23609]: ALERT - configured request
variable value length limit exceeded - dropped variable 'content'
(attacker '192.168.1.2', file '/var/www/site/index.php')
Apr  1 12:24:34 localhost suhosin[3729]: ALERT - configured request
variable value length limit exceeded - dropped variable 'introtext'
(attacker '192.168.1.2', file '/var/www/site/administrator/index2.php')
Apr  1 12:40:24 localhost suhosin[23610]: ALERT - configured request
variable value length limit exceeded - dropped variable 'content'
(attacker '192.168.1.2', file '/var/www/site/index.php')

That way you'll be able to add rules/decoder.

You can find informations about suhosin here :
http://www.hardened-php.net/suhosin.127.html

Thanks

Sioban.