audit.ini [AlertRule_brute_force] #

The block [AlertRule_brute_force] of settings/audit.ini, with 7 setting(s).

Recipients[]=admin
Recipients[]=group:security
Recipients[]=role:Administrator
Named recipient groups: [AlertRecipients_<name>], referenced as group:<name> from
Recipients[] here or in a rule. Addresses[] lists e-mail addresses; Recipients[] may
name any of the kinds above (other groups too; loops are cut).
[AlertRecipients_security]
Addresses[]
Addresses[][email protected]
Addresses[][email protected]
Recipients[]
Recipients[]=usergroup:12
Recipients[]=login:editor1
An INI rule: Event (pattern), Threshold (events), Window (seconds), GroupBy (record
field), Severity, Sinks[], Class (default threshold), Recipients[] (who is mailed when
Sinks[] has mail; empty = [AuditAlertSettings] Recipients[]). Each fires
system.audit.alert. Example:
[AlertRule_brute_force]
Recipients[]
Recipients[]=group:security
Recipients[]=address:[email protected]

Never edit settings/audit.ini itself: an update replaces it. Put the settings you change in an override, which wins over the shipped file:

• settings/override/audit.ini.append.php for every siteaccess,
• settings/siteaccess/<siteaccess>/audit.ini.append.php for one siteaccess,
• extension/<extension>/settings/audit.ini.append.php in an extension (read when the extension is active).

Class #

Many failed logins from one network.

Default: threshold.

<?php /* #?ini charset="utf-8"?
# settings/override/audit.ini.append.php
[AlertRule_brute_force]
Class=threshold
*/ ?>

Event #

Default: access.session.login.failed.

<?php /* #?ini charset="utf-8"?
# settings/override/audit.ini.append.php
[AlertRule_brute_force]
Event=access.session.login.failed
*/ ?>

Threshold #

Default: 20.

<?php /* #?ini charset="utf-8"?
# settings/override/audit.ini.append.php
[AlertRule_brute_force]
Threshold=20
*/ ?>

Window #

Default: 300.

<?php /* #?ini charset="utf-8"?
# settings/override/audit.ini.append.php
[AlertRule_brute_force]
Window=300
*/ ?>

GroupBy #

Default: actor.ip.

<?php /* #?ini charset="utf-8"?
# settings/override/audit.ini.append.php
[AlertRule_brute_force]
GroupBy=actor.ip
*/ ?>

Severity #

Default: critical.

<?php /* #?ini charset="utf-8"?
# settings/override/audit.ini.append.php
[AlertRule_brute_force]
Severity=critical
*/ ?>

Sinks #

Default: a list of 2: syslog, mail.

<?php /* #?ini charset="utf-8"?
# settings/override/audit.ini.append.php
[AlertRule_brute_force]
# an empty "Sinks[]" first replaces the shipped list; without it the items are added
Sinks[]
Sinks[]=syslog
Sinks[]=mail
*/ ?>

Related #

• All blocks of audit.ini
• All INI files
• The settings page

Generated by ./console exp:help:examples from settings/audit.ini. Do not edit this page: change the source and generate again (how). Free documentation: GFDL 1.3 or later.