Next: , Previous: weird Module, Up: weird Module



7.24.1 Actions for “weird” events

The general approach taken by the module is to categorize for each event the action to take when the event engine generates the event. Table XX summarizes the different possible actions.

Action Meaning
WEIRD_UNSPECIFIED No action specified.
WEIRD_IGNORE Ignore the event.
WEIRD_FILE Record the event to weird file, if it has not been seen for these hosts before. (But see weird do not ignore repeats.)
WEIRD_LOG_ALWAYS Record the event to weird file and generate a real-time alert each time the event occurs.
WEIRD_LOG_ONCE Record the event to weird file; generate a real-time alert the first time the event occurs.
WEIRD_LOG_PER_CONN Record the event to weird file; generate a real-time alert the first time it occurs for a given connection.
WEIRD_LOG_PER_ORIG Record the event to weird file; generate a real-time alert the first time it occurs for a given originating host.

Table 7.9: Different types of possible actions to take for "weird" events