X-Git-Url: http://ftp.carnet.hr/carnet-debian/scm?a=blobdiff_plain;ds=sidebyside;f=debian%2Fossec-hids%2Fvar%2Fossec%2Frules%2Fnsd_rules.xml;fp=debian%2Fossec-hids%2Fvar%2Fossec%2Frules%2Fnsd_rules.xml;h=0000000000000000000000000000000000000000;hb=946517cefb8751a43a89bda4220221f065f4e5d1;hp=e561ab0f9949a8cab024e91585ede367d1e31758;hpb=3f728675941dc69d4e544d3a880a56240a6e394a;p=ossec-hids.git

diff --git a/debian/ossec-hids/var/ossec/rules/nsd_rules.xml b/debian/ossec-hids/var/ossec/rules/nsd_rules.xml
deleted file mode 100644
index e561ab0..0000000
--- a/debian/ossec-hids/var/ossec/rules/nsd_rules.xml
+++ /dev/null
@@ -1,97 +0,0 @@
-<!--
-Aug 11 13:21:46 ix nsd[16565]: server initialization failed, nsd could not be started
-Aug 11 13:22:14 ix nsd[13816]: blocked.hosts:2: syntax error
-Aug 11 13:22:14 ix nsd[13816]: blocked.hosts:2: unrecognized RR type 'name:'
-Aug 12 09:01:00 junction.example.com nsd[7405]: NSTATS 1439384460 1439314258 A=1 AAAA=1
-Aug 12 09:01:00 junction.example.com nsd[7405]: XSTATS 1439384460 1439314258 RR=0 RNXD=0 RFwdR=0 RDupR=0 RFail=0 RFErr=0 RErr=0 RAXFR=0 RLame=0 ROpts=0 SSysQ=0 SAns=2 SFwdQ=0 SDupQ=0 SErr=0 RQ=2 RIQ=0 RFwdQ=0 RDupQ=0 RTCP=0 SFwdR=0 SFail=0 SFErr=0 SNaAns=0 SNXD=0 RUQ=0 RURQ=0 RUXFR=0 RUUpd=0
-Dec 16 12:51:17 pine nsd[90235]: xfrd: zone example.com received error code NOT IMPL from 192.168.17.9@153
-
--->
-
-<group name="syslog,dns,nsd,">
-  <rule id="53200" level="0">
-    <decoded_as>nsd</decoded_as>
-    <description>NSD grouping.</description>
-  </rule>
-
-  <rule id="53201" level="1">
-    <if_sid>53200</if_sid>
-    <match>unrecognized RR type</match>
-    <description>Syntax error in nsd configuration.</description>
-  </rule>
-
-  <rule id="53202" level="1">
-    <decoded_as>nsd</decoded_as>
-    <if_sid>53200</if_sid>
-    <match>server initialization failed|syntax error$</match>
-    <description>Syntax error in nsd configuration.</description>
-  </rule>
-
-  <rule id="53203" level="0">
-    <if_sid>53200</if_sid>
-    <match>^NSTATS|^XSTATS</match>
-    <description>nsd statistics</description>
-  </rule>
-
-  <rule id="53204" level="2">
-    <decoded_as>nsd</decoded_as>
-    <match>Can't bind </match>
-    <description>Cannot bind to a socket.</description>
-  </rule>
-
-  <rule id="53205" level="2">
-    <decoded_as>nsd</decoded_as>
-    <match>nsd is already running</match>
-    <description>nsd is already running.</description>
-  </rule>
-
-  <rule id="53206" level="1">
-    <decoded_as>nsd</decoded_as>
-    <if_sid>53200</if_sid>
-    <match>received notify response error NOT IMPL</match>
-    <description>Notify is not implemented.</description>
-  </rule>
-
-  <rule id="53207" level="1">
-    <decoded_as>nsd</decoded_as>
-    <if_sid>53200</if_sid>
-    <regex>read with \d+ errors$</regex>
-    <description>Zone file read with errors.</description>
-  </rule>
-
-  <rule id="53208" level="0">
-    <decoded_as>nsd</decoded_as>
-    <if_sid>53200</if_sid>
-    <match>received error code </match>
-    <description>Error grouping.</description>
-  </rule>
-
-  <rule id="53209" level="1">
-    <decoded_as>nsd</decoded_as>
-    <if_sid>53208</if_sid>
-    <match>NOT IMPL </match>
-    <description>Zone xfer not implemented.</description>
-  </rule>
-
-  <rule id="53210" level="1">
-    <if_sid>53200</if_sid>
-    <match>tcp: Connection reset by peer$</match>
-    <description>tcp connection reset.</description>
-  </rule>
-
-  <rule id="53211" level="1">
-    <if_sid>53200</if_sid>
-    <match>received error code NOT IMPL</match>
-    <description>Attempted zone transfer not configured.</description>
-  </rule>
-
-  <rule id="53212" level="1">
-    <if_sid>53208</if_sid>
-    <match>received error code SERVER NOT AUTHORITATIVE FOR ZONE</match>
-    <description>Server not authoritative for zone transfer.</description>
-  </rule>
-
-
-</group>
-
-