[Prelude Hybrid IDS] #218: no way to ignore events

#218: no way to ignore events
-------------------------------------------------+--------------------------
 Reporter:  Pierre Chifflier <[email protected]>  |       Owner:  yoann
     Type:  defect                               |      Status:  new  
 Priority:  normal                               |   Milestone:       
Component:  prelude-lml                          |     Version:  0.9  
 Severity:  normal                               |    Keywords:       
-------------------------------------------------+--------------------------
 I'm trying to ignore cron events, for ex:
 {{{
 Apr 20 15:55:01 piche /USR/SBIN/CRON[29497]: (root) CMD
 (/usr/share/vzctl/scripts/vpsreboot)
 }}}

 I've create a file cron.rules:
 {{{
 regex=CRON; \
  silent; \
  last
 }}}
 (tried with or without the silent line, no change)

 and added the following to pcre.rules:
 {{{
 regex=CRON;                             include = cron.rules;
 }}}

 However, alerts are still sent to the manager (causing a nice flood of
 cron events ;)

 prelude-lml 0.9.8.1 (debian unstable)

-- 
Ticket URL: <https://trac.prelude-ids.org/ticket/218>
Prelude Hybrid IDS <http://www.prelude-ids.org>
The Prelude Hybrid Intrusion Detection System suite
_______________________________________________
Prelude-devel site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-devel