X-Git-Url: http://ftp.carnet.hr/carnet-debian/scm?p=ossec-hids.git;a=blobdiff_plain;f=etc%2Frules%2Fapache_rules.xml;h=425c0b9eeaf31b02a6cdb2860013af73bcde13e5;hp=f823886cd0f6249b16c00a54cd876f476a315520;hb=6ef2f786c6c8ead94841b5f93baf9f43421f08c8;hpb=301048b51990573e58a30dc4a5bb4ec285cad554

diff --git a/etc/rules/apache_rules.xml b/etc/rules/apache_rules.xml
index f823886..425c0b9 100755
--- a/etc/rules/apache_rules.xml
+++ b/etc/rules/apache_rules.xml
@@ -1,4 +1,5 @@
-<!-- @(#) $Id$
+<!-- @(#) $Id: ./etc/rules/apache_rules.xml, 2011/09/08 dcid Exp $
+
   -  Official Apache rules for OSSEC.
   -
   -  Copyright (C) 2009 Trend Micro Inc.
@@ -79,7 +80,7 @@
 
   <rule id="30109" level="9">
     <if_sid>30101</if_sid>
-    <regex>user \S+ not found</regex>
+    <regex>user \S+ not found|user \S+ in realm \.* not found</regex>
     <description>Attempt to login using a non-existent user.</description>
     <group>invalid_login,</group>
   </rule>