From 1054ca8433b4ad5e55ba58a3e0922fbd8edfdad4 Mon Sep 17 00:00:00 2001
From: Dinko Korunic <kreator@carnet.hr>
Date: Sat, 12 Sep 2009 11:06:47 +0200
Subject: [PATCH]   * ignoriranje BIND cache gresaka   * ignoriranje anacron
 gresaka (Yum program...)

---
 debian/changelog |    7 +++++++
 debian/postinst  |   24 ++++++++++++++++++------
 2 files changed, 25 insertions(+), 6 deletions(-)

diff --git a/debian/changelog b/debian/changelog
index 6c4660f..c484805 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+ossec-hids-cn (2.0-2) stable; urgency=low
+
+  * ignoriranje BIND cache gresaka
+  * ignoriranje anacron gresaka (Yum program...)
+
+ -- Dinko Korunic <kreator@carnet.hr>  Sat, 12 Sep 2009 11:03:24 +0200
+
 ossec-hids-cn (2.0-1) stable; urgency=low
 
   * depend o novom upstream paketu
diff --git a/debian/postinst b/debian/postinst
index f059b13..fbd287f 100755
--- a/debian/postinst
+++ b/debian/postinst
@@ -73,7 +73,7 @@ fi
 
 cp-update --comment '<!--' --comment-end '-->' \
     ossec-hids-cn "$local_rules.$$" <<EOF
-<group name="syslog,errors,local">
+<group name="local">
  <rule id="$(expr "$sid" + 1)" level="0">
    <if_sid>1002</if_sid>
    <match>rsync</match>
@@ -83,20 +83,32 @@ cp-update --comment '<!--' --comment-end '-->' \
  <rule id="$(expr "$sid" + 2)" level="0">
    <if_sid>1002</if_sid>
    <program_name>^sophie|^smartd</program_name>
-   <description>Events ignored</description>
+   <description>Ignore Sophie/SMARTd</description>
  </rule>
-</group>
 
-<group name="syslog,postfix,local">
  <rule id="$(expr "$sid" + 3)" level="0">
    <if_sid>3303</if_sid>
    <description>Events ignored</description>
  </rule>
 
  <rule id="$(expr "$sid" + 4)" level="0">
-  <if_sid>3356</if_sid>
-  <description>Ignore blacklisted mail</description>
+   <if_sid>3356</if_sid>
+   <description>Ignore blacklisted mail</description>
  </rule>
+
+ <rule id="$(expr "$sid" + 5)" level="0">
+   <if_sid>1002</if_sid>
+   <match>cache</match>
+   <program_name>^named</program_name>
+   <description>Ignore BIND cache warnings</description>
+ </rule> 
+
+ <rule id="$(expr "$sid" + 6)" level="0">
+   <if_sid>2933</if_sid>
+   <match>Updated timestamp for job</match>
+   <program_name>^anacron</program_name>
+   <description>Ignore Anacron warnings</description>
+ </rule> 
 </group>
 EOF
 cp_mv "$local_rules.$$" "$local_rules"
-- 
1.7.10.4