[ossec-list] Re: adsl rule

["Daniel Cid" <daniel.cid@xxxxxxxxx>]

Hi Martin,

Is the rule working or not working (I wasn't really sure from your
e-mail)? I see that you specified the "decoded_as" on rule 101000, but
did you create a decoder for it? The
decoded_as looks for a valid decoder name on decoders.xml....

If it is not working, try changing rule 101000 to:

<rule id="101000" level="0" noalert="1">
    <program_name>kernel</program_name>
    <description>Grouping for the adsl rules.</description>
</rule>


Hope it helps.

--
Daniel B. Cid
dcid ( at ) ossec.net

On 4/7/07, Martin West <martin@xxxxxxxxxxxxxxxx> wrote:
> I wrote a rule
>
> <group name="local,syslog,">
>
>   <rule id="101000" level="0" noalert="1">
>       <decoded_as>adsl</decoded_as>
>       <description>Grouping for the adsl rules.</description>
>   </rule>
>
>     <rule id="101001" level="8">
>       <if_sid>101000</if_sid>
>       <description>Monitor adsl line down</description>
>       <match>ADSL line is down</match>
>     </rule>
>
>     <rule id="101002" level="8">
>       <if_sid>101000</if_sid>
>       <description>Monitor adsl line up</description>
>       <match>ADSL line is up</match>
>     </rule>
>
> </group> <!-- SYSLOG,LOCAL -->
>
> to check for log entries ...
>
> Apr  7 16:57:02 thecla2 kernel: ATM dev 0: ADSL line is down
> Apr  7 16:57:03 thecla2 kernel: ATM dev 0: ADSL line is synchronising
> Apr  7 16:57:43 thecla2 kernel: ATM dev 0: ADSL line is up (2656 kb/s
> down | 448 kb/s up)
>
> However it does seem to trigger, well at least generate an email.
>
> It gets loaded ...
>
> 2007/04/04 23:44:34 ossec-analysisd: Reading rules file:
> 'adsl_rules.xml'
>
> Is it just me or is the documentation a bit sparse?
>
> Thanks Martin West