The general approach taken by the module is to categorize for each event the action to take when the event engine generates the event. Table XX summarizes the different possible actions.
Action | Meaning
|
WEIRD_UNSPECIFIED | No action specified.
|
WEIRD_IGNORE | Ignore the event.
|
WEIRD_FILE | Record the event to weird file, if it has not been seen for these hosts before. (But see
weird do not ignore repeats.)
|
WEIRD_LOG_ALWAYS | Record the event to weird file and generate a real-time alert each time the event occurs.
|
WEIRD_LOG_ONCE | Record the event to weird file; generate a real-time alert the first time the event occurs.
|
WEIRD_LOG_PER_CONN | Record the event to weird file; generate a real-time alert the first time it occurs for a
given connection.
|
WEIRD_LOG_PER_ORIG | Record the event to weird file; generate a real-time alert the first time it occurs for a
given originating host.
|
Table 7.9: Different types of possible actions to take for "weird" events