Linux OSSEC | 如何添加例外规则
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/8921570/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
OSSEC | How to add an exception rule
提问by Anton Shevtsov
I have the standard syslog_rules.xml (OSSEC 2.6.0).
This is the standard rule for bad words in the /var/log/messagesfile:
我有标准的 syslog_rules.xml (OSSEC 2.6.0)。这是/var/log/messages文件中坏词的标准规则：
<var name="BAD_WORDS">core_dumped|failure|error|attack|bad |illegal |denied|refused|unauthorized|fatal|failed|Segmentation Fault|Corrupted</var>
.....
<rule id="1002" level="2">
<match>$BAD_WORDS</match>
<options>alert_by_email</options>
<description>Unknown problem somewhere in the system.</description>
</rule>
.....
How can I add or modify this rule that uses $BAD_WORDS, but excludes the auxpropfunc errorphrase? That is, something like this:
如何添加或修改使用$BAD_WORDS，但排除auxpropfunc error短语的规则？也就是说，像这样：
<match>$BAD_WORDS</match>
<match>!auxpropfunc error</match>
<options>alert_by_email</options>
Any ideas?
有任何想法吗？
采纳答案by Dan Parriott
Your best option is probably to write a rule to ignore that phrase. You could add something like the following to /var/ossec/rules/local_rules.xml:
您最好的选择可能是编写一条规则来忽略该短语。您可以将类似以下内容添加到/var/ossec/rules/local_rules.xml：
<rule id="SOMETHING" level="0">
<if_sid>1002</if_sid>
<match>auxpropfunc error</match>
<description>Ignore auxpropfunc error.</description>
</rule>
You could then run the entire log message through ossec-logtest to see how OSSEC will analyze it. You may need to add another option into this rule, or you may not.
然后，您可以通过 ossec-logtest 运行整个日志消息，以查看 OSSEC 将如何对其进行分析。您可能需要在此规则中添加另一个选项，也可能不需要。
回答by Rafael Brito Gomes
If you have more than one word, you could add something like the following to /var/ossec/rules/local_rules.xml
如果您有多个单词，您可以在 /var/ossec/rules/local_rules.xml 中添加类似以下内容
<var name="GOOD_WORDS">error_reporting|auxpropfunc error</var>
<rule id="100002" level="0">
<if_sid>1002</if_sid>
<match>$GOOD_WORDS</match>
<description>Ignore good_words.</description>
</rule>
