audit.ini [AlertRule_brute_force_user]
The block [AlertRule_brute_force_user] of settings/audit.ini, with 7 setting(s).
Never edit settings/audit.ini itself: an update replaces it. Put the settings you change in an override, which wins over the shipped file:
settings/override/audit.ini.append.phpfor every siteaccess,settings/siteaccess/<siteaccess>/audit.ini.append.phpfor one siteaccess,extension/<extension>/settings/audit.ini.append.phpin an extension (read when the extension is active).
Class
Many failed logins for one account, from anywhere.
Default: threshold.
# settings/override/audit.ini.append.php
[AlertRule_brute_force_user]
Class=threshold
*/ ?>Event
Default: access.session.login.failed.
# settings/override/audit.ini.append.php
[AlertRule_brute_force_user]
Event=access.session.login.failed
*/ ?>Threshold
Default: 10.
# settings/override/audit.ini.append.php
[AlertRule_brute_force_user]
Threshold=10
*/ ?>Window
Default: 900.
# settings/override/audit.ini.append.php
[AlertRule_brute_force_user]
Window=900
*/ ?>GroupBy
Default: object.id.
# settings/override/audit.ini.append.php
[AlertRule_brute_force_user]
GroupBy=object.id
*/ ?>Severity
Default: alert.
# settings/override/audit.ini.append.php
[AlertRule_brute_force_user]
Severity=alert
*/ ?>Sinks
Default: a list of 2: syslog, mail.
# settings/override/audit.ini.append.php
[AlertRule_brute_force_user]
# an empty "Sinks[]" first replaces the shipped list; without it the items are added
Sinks[]
Sinks[]=syslog
Sinks[]=mail
*/ ?>Related
Generated by ./console exp:help:examples from settings/audit.ini. Do not edit this page: change the source and generate again (how). Free documentation: GFDL 1.3 or later.