On Thu, Feb 2, 2012 at 5:03 AM, alsdks <als...@gmail.com> wrote: > Hello list, > > > Some systems , in syslog logging , tend to group same messages to save > space and load. For example Solaris > logs failed ssh logins to syslog but issues an event that says that > the last message repeated x times, like : > > sshd[22082]: [ID 800047 auth.notice] Failed keyboard-interactive > for .... > Feb 2 10:38:00 systemname last message repeated 1 time > > > This way rule ID 5720 triggers at actually about 10 failed logins > instead of 8. > > Is there a way to work around this ? Maybe lower the threshold for > specific systems\platforms ? > > The same goes for telnet logging which does summarize a lot these > events .Probably other services too . > > Thank you !
Maybe you could turn off the "message repeated" messages. Or I guess you could use the overwrite option to the rules that are issues to lower the frequency for your environment.
