Adding offenders timeout

hostingguy · **Joined:** Mon Oct 29, 2007 6:51 pm **Posts:** 613

Can some one briefly explain what this means

Quote:

Shutting down ossec-hids: cat: /var/ossec/var/start-script-lock/pid: No such file or directory [ OK ]
Starting ossec-hids: 2012/01/27 12:04:24 ossec-execd: INFO: Adding offenders timeout: 12 (for #1)
2012/01/27 12:04:24 ossec-execd: INFO: Adding offenders timeout: 24 (for #2)
2012/01/27 12:04:24 ossec-execd: INFO: Adding offenders timeout: 48 (for #3) [ OK ]

I understand ossec is restarting or possibly starting since it may not have been running (this was a notice from psmon) and I am guessing that its attempting to add back in any shuns that may not be present and should be, but I dont know why its always listed 3 times and what the difference for the time out values are, and how it gets 12, 24, 48.

scott · **Posted:** Mon Jan 30, 2012 4:13 pm

The HIDS_SHUN_MULTIPLIER is the value it uses to determine the repeat offender block intervals (0 disables this feature). It currently supports 3 levels. Note also that OSSEC_SHUN_TIME is calculated in seconds.

hostingguy · **Joined:** Mon Oct 29, 2007 6:51 pm **Posts:** 613

ASL shun time is in the hundreds, so I still dont know what the 12, 24, 48 is for.

Adding offenders timeout

Who is online