Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

My server is sending me the below error message to my email every five minutes:

OSSEC HIDS Notification.
2011 Jun 17 16:30:03

Received From: ubuntu->/var/log/syslog
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Jun 18 08:30:01 ubuntu CRON[16935]: (www-data) CMD (php /usr/share/cacti/site/poller.php >/dev/null 2>/var/log/cacti/poller-error.log)

Any ideas on what it means?

share|improve this question

1 Answer 1

I believe looking as this rule which is below, basically if I'm not wrong this is where OSSEC fails through the cracks and ends up hitting this rule. There will always be this rule firing when new unknown syslogs appear and in your case it was Cacti polling log which it doesn't know about.

<rule id="1002" level="2">
  <match>$BAD_WORDS</match>
  <options>alert_by_email</options>
  <description>Unknown problem somewhere in the system.</description>
</rule>

You will need to add rules to match syslogs that are good and write rule to alarm on the bad.

OSSECs site explains this here http://www.ossec.net/wiki/Know_How:Email_Alerts_below_7

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.