Re: False positive alerts with log rotation from prelude-lml

Hi Alexander,

Le mercredi 03 septembre 2008 à 16:47 +0300, Alexander Afonyashin a
écrit :
> I'm getting false positive alerts while logs are being monitored by prelude-lml.
> 
> The description of one of these alerts is:
> "An inconsistency has been observed in file rotation: The differences between the 
> previously observed rotation time and size are higher than the allowed limits: 
> size difference=1216 bytes allowed=1024 bytes, time difference=14398 
> seconds allowed=300 seconds"
> 
> The rotation is performed by newsyslog started by cron every our. The criteria to 
> rotate is fact that log file size is over 100Kb. The old file is gziped.
> 
> Now the list of files (ls -l /var/log/auth*):
> 
> -rw-------  1 root  wheel  10079 Sep  3 17:27 /var/log/auth.log
> -rw-------  1 root  wheel  12021 Sep  3 16:00 /var/log/auth.log.0.gz
> -rw-------  1 root  wheel  12412 Sep  3 06:00 /var/log/auth.log.1.gz
> -rw-------  1 root  wheel  12012 Sep  2 16:00 /var/log/auth.log.2.gz
> 
> Alert is dated Sep 3, 16:00:01. What goes wrong?

At the time your rotation program is started, chance is that your log
file already exceed the 'max-rotation-size-offset' value, and thus LML
generate an alert.

You could try increasing this option value in order to lower chance of
false positive.

Regards,

-- 
Yoann Vandoorselaere | Responsable R&D / CTO | PreludeIDS Technologies
Tel: +33 (0)8 70 70 21 58                  Fax: +33(0)4 78 42 21 58
http://www.prelude-ids.com

_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user