False positive alerts with log rotation from prelude-lml
"Alexander Afonyashin" <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <[email protected]> |
Hi all. I'm getting false positive alerts while logs are being monitored by prelude-lml. The description of one of these alerts is: "An inconsistency has been observed in file rotation: The differences between the previously observed rotation time and size are higher than the allowed limits: size difference=1216 bytes allowed=1024 bytes, time difference=14398 seconds allowed=300 seconds" The rotation is performed by newsyslog started by cron every our. The criteria to rotate is fact that log file size is over 100Kb. The old file is gziped. Now the list of files (ls -l /var/log/auth*): -rw------- 1 root wheel 10079 Sep 3 17:27 /var/log/auth.log -rw------- 1 root wheel 12021 Sep 3 16:00 /var/log/auth.log.0.gz -rw------- 1 root wheel 12412 Sep 3 06:00 /var/log/auth.log.1.gz -rw------- 1 root wheel 12012 Sep 2 16:00 /var/log/auth.log.2.gz Alert is dated Sep 3, 16:00:01. What goes wrong? Best regards, Alexander Afonyashin -- Be Yourself @ mail.com! Choose From 200+ Email Addresses Get a Free Account at www.mail.com _______________________________________________ Prelude-user site list [email protected] http://lists.prelude-ids.org/mailman/listinfo/prelude-user