[ossec-list] Re: filter rules on host and log file?

["Daniel Cid" <daniel.cid@xxxxxxxxx>]

Hi Philipp,

OSSEC does not support Squid's store logs, since they do not contain any useful
information to us. We only support the access log from Squid...

Thanks,

--
Daniel B. Cid
dcid ( at ) ossec.net


On 10/10/07, metacosmic@xxxxxxxxx <metacosmic@xxxxxxxxx> wrote:
>
> hi *,
>
> also sorry for the late answer :)
>
> i should read mails i send twice or more ;)
> i am having the problem on my squid servers ...
> on client side the squid log files are configured
> as log_format squid ...
> the reported error in the ui looks like this
> because of spam i decreased the log level ;)
>
> 2007 Oct 10 11:26:14 Rule Id: 100202 level: 4
> Location: (squid1) x.x.x.x->/var/adm/squid/logs/store.log
> too many Unknown problem somewhere in the system
> 1192008372.652 RELEASE -1 FFFFFFFF D95F507FBFFB468CC31EADF45B5FC484
> 200 1192008142 -1 1192008742 text/xml 38278/38278 GET
> http://rss.news.yahoo.com/rss/terrorism
>
> hope this helps out ...
>
> cheers
> philipp
>
> On 28 Sep., 03:03, "Daniel Cid" <daniel....@xxxxxxxxx> wrote:
> > Hi Philipp,
> >
> > Sorry for the late reply... Catching up on e-mails :)
> >
> > Your web servers logs should not be checked against rule 1002, which
> > is exclusive to
> > syslog messages. Internally, on ossec, we separate the logs per
> > category (weblog, syslog, proxy, firewall, etc) and it wouldn't match
> > Apache logs against syslog ones, unless the
> > apache log is not being decoded properly.
> >
> > Can you show us a sample from your logs? Are they in a different
> > format than the default
> > apache one?
> >
> > Thanks,
> >
> > --
> > Daniel B. Cid
> > dcid ( at ) ossec.net
> >
> > On 9/4/07, metacos...@xxxxxxxxx <metacos...@xxxxxxxxx> wrote:
> >
> >
> >
> > > hi *,
> >
> > > i run ossec agent on several web servers where i monitor the system
> > > files and the webserver log files.
> > > now i ran into a problem with the rule
> >
> > > Rule: 1002 fired (level 7) -> "Unknown problem somewhere in the
> > > system."
> >
> > > this rules (is my understanding) is just a pattern matching of bad
> > > words or?
> > > and here starts my problem ;)
> >
> > > there might be session id in the webserver logfiles wich includes the
> > > three letters bad ...
> > > there might be a valid html slide with the name terrorist
> > > there might be a valid html slide with the name errorxyz ...
> >
> > > all this stuf fires up the rules 1002 :)
> >
> > > therefor i don´t want to apply the rules to the webserver log files
> > > but of curse to the system log files on this host ...
> > > i don't have the slightest idea of howto manage this with rules
> > > section :)
> >
> > > ideas very welcome!
> >
> > > cheers
> > > philipp
>
>