Well, Sid's no help to me really. In fact I've unFriended him.
Thankfully, there's already a suhosin decoder in OSSEC, with a "type" of "ids" in decoder.xml
<regex>^ALERT - (\.+) \(attacker '(\d+.\d+.\d+.\d+)', </regex>
<fts>name, location, id</fts>
[50_asl_]ids_rules.xms has two main rules that will trigger on suhosin events, and they are what's really causing the problem:
<rule id="20100" level="8">
<description>First time this IDS alert is generated.</description>
<rule id="20101" level="6">
The first one is a First Time Seen rule, default Level 8.
This means that any suhosin event that happens that's not been seen before (before when? -- I can't figure out where the FTS queue is held) will be Level 8 and will block.
Obviously this can be changed, but as I want to specifically target suhosin, we don't really want to change it. It is Level 8 for a reason, really.
Next, we have a Level 6 rule that will trigger if the suhosin event has been seen before. Again we don't want to touch that because it is a generic rule and we want to specifically target suhosin.
So, as far as I can see, the only solution to this is to modify the existing suhosin decoder and change <type>ids</type> to a custom value, such as "suhosin", when create the required rules in local_rules.xml - maybe a generic suhosin rule at level 8 and a specific rule matching the memory allocation rule at level 5.
The problem is that decoder.xml will get overwritten every time ossec us updated.
There is an option for local_decoder.xml or indeed to put a decoder file in decoders.d as has been done for the 01_asl_decoder.xml
So, I wonder if I can override an existing decoder by simply saving a local_decoder.xml file in decoders.d which redefines the "suhosin" decoder in decoder.xml?
I may try it later, but if anybody knows whether this will work or not then I'd appreciate it.