new upstream release (3.3.0); modify package compatibility for Stretch

[ossec-hids.git] / debian / ossec-hids / var / ossec / rules / systemd_rules.xml

diff --git a/debian/ossec-hids/var/ossec/rules/systemd_rules.xml b/debian/ossec-hids/var/ossec/rules/systemd_rules.xml
new file mode 100644 (file)
index 0000000..3ad0967
--- /dev/null
+++ b/debian/ossec-hids/var/ossec/rules/systemd_rules.xml
@@ -0,0 +1,27 @@
+<group name="local,systemd,">
+
+  <rule id="40700" level="0">
+    <program_name>^systemd$|^systemctl$</program_name>
+    <description>Systemd rules</description>
+  </rule>
+
+  <rule id="40701" level="0">
+    <if_sid>40700</if_sid>
+    <match> Stale file handle$</match>
+    <description>Stale file handle.</description>
+  </rule>
+
+  <rule id="40702" level="2">
+    <if_sid>40700</if_sid>
+    <match>Failed to get unit file state for</match>
+    <description>Failed to get unit state for service. This means that the .service file is missing</description>
+  </rule>
+
+  <rule id="40703" level="5">
+    <if_sid>40700</if_sid>
+    <match>entered failed state</match>
+    <description>Service has entered a failed state, and likely has not started.</description>
+  </rule>
+
+</group>
+