<description>Bad ntp peer.</description>
</rule>
+ <rule id="51533" level="1">
+ <program_name>^dhclient$</program_name>
+ <if_sid>1002</if_sid>
+ <match>receive_packet failed on </match>
+ <description>dhclient receive_packet failed.</description>
+ </rule>
+
+ <rule id="51534" level="1">
+ <if_sid>51533</if_sid>
+ <match>Input/output error$</match>
+ <description>dhclient receive_packet failed due to I/O error.</description>
+ </rule>
+
+ <rule id="51535" level="1">
+ <program_name>^dhclient$</program_name>
+ <if_sid>1002</if_sid>
+ <match>SIOCDIFADDR failed </match>
+ <description>SIOCDIFADDR failed</description>
+ </rule>
+
+ <rule id="51536" level="1">
+ <if_sid>51535</if_sid>
+ <match> Device not configured$</match>
+ <description>dhclient: device not configured.</description>
+ </rule>
+
+</group>
+
+<group name="local,syslog,openbsd,doas">
+
+ <rule id="51550" level="0">
+ <decoded_as>doas</decoded_as>
+ <description>doas grouping</description>
+ </rule>
+
+ <rule id="51551" level="1">
+ <if_sid>51550</if_sid>
+ <match>cannot stat</match>
+ <description>doas cannot stat a file.</description>
+ </rule>
+
+ <rule id="51552" level="2">
+ <if_sid>51551</if_sid>
+ <match>: Permission denied$</match>
+ <description>doas cannot stat a file due to permissions.</description>
+ </rule>
+
+ <rule id="51553" level="5">
+ <if_sid>51550</if_sid>
+ <match>path not secure$</match>
+ <description>A critical path for doas does not have secure permissions.</description>
+ </rule>
+
+ <rule id="51554" level="5">
+ <if_sid>51550</if_sid>
+ <match>failed command for </match>
+ <description>Failed doas command.</description>
+ </rule>
+
+ <rule id="51555" level="1">
+ <if_sid>51550</if_sid>
+ <match>ran command</match>
+ <description>A command was run using doas.</description>
+ </rule>
+
+ <rule id="51556" level="2">
+ <if_sid>51555</if_sid>
+ <match> as root </match>
+ <description>A doas command was run as root.</description>
+ </rule>
+
+ <rule id="51557" level="5">
+ <if_sid>51550</if_sid>
+ <match>failed auth for</match>
+ <description>doas authentication failed.</description>
+ </rule>
+
+ <rule id="51558" level="4">
+ <program_name>sendsyslog</program_name>
+ <match>^dropped </match>
+ <description>sendsyslog dropped log messages.</description>
+ </rule>
</group> <!-- SYSLOG,LOCAL -->