Discussion on ticket #307

Hi all

I was asked at #prelude to deal with error log format of Apache, so I've created new [apache-error] section with new prefix-regex. It matches against events described in httpd.rules (eventid=4100). But later the same person asked me to update rules to deal with events like:

[Fri Dec  6 13:40:08 2002] [notice] child pid 32537 exit signal Segmentation fault (11)

This event format differs from regex I've introduced since no hostname is given (because it's the host where httpd is running) and pid exists. So the question is:
- do we need separate [apache-segfault] section with separate regex or we may deal with these events in [apache-error] section?

Also httpd.rules needs to be updated to support this event.

Best regards,
Alexander Afonyashin

-- 
Be Yourself @ mail.com!
Choose From 200+ Email Addresses
Get a Free Account at www.mail.com

_______________________________________________
Prelude-devel site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-devel