OSSEC HIDS alert: Rule: 1003 fired (level 13) -> "Non standard syslog message (size too large)."

Question

I am running the latest stable version of OSSEC HIDS (2.8.1), and I recently received an email notification (as I have enabled them) saying this:

OSSEC HIDS Notification. 2015 Apr 20 11:23:04

Received From: Bath-Towel->/var/log/syslog Rule: 1003 fired (level 13) -> "Non standard syslog message (size too large)." Portion of the log(s):

Apr 20 11:23:03 Bath-Towel kernel: [ 5864.618792] Modules linked in: nfnetlink_queue nfnetlink_log nfnetlink bnep rfcomm bluetooth 6lowpan_iphc uvcvideo videobuf2_vmalloc videobuf2_memops videobuf2_core v4l2_common videodev keucr(C) media xt_hl ip6t_rt nf_conntrack_ipv6 nf_defrag_ipv6 ip6t_REJECT xt_LOG xt_limit xt_tcpudp xt_addrtype nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack ipt_REJECT arc4 ip6table_filter ip6_tables brcmsmac nf_conntrack_netbios_ns nf_conntrack_broadcast nf_nat_ftp cordic nf_nat brcmutil nf_conntrack_ftp b43 nf_conntrack iptable_filter mac80211 ip_tables x_tables snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_codec_generic cfg80211 ssb intel_rapl x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm crct10dif_pclmul crc32_pclmul ghash_clmulni_intel cryptd snd_hda_intel snd_hda_controller snd_hda_codec bcma joydev snd_hwdep serio_raw thinkpad_acpi nvram snd_pcm snd_seq_midi lpc_ich shpchp snd_seq_midi_event mei_me snd_rawmidi mei i915(OE) drm_kms_helper(OE) drm(OE) i2c_algo_bit snd_seq wmi snd_seq_device snd_timer parport_pc snd ppdev soundcore lp parport binfmt_misc video mac_hid uas ahci usb_storage psmouse r8169 libahci mii

--END OF NOTIFICATION

This suddenly appeared out of the blue and I find no obvious reason for why I would suddenly get an alert such as this one (I was not doing anything at the time which was making any major changes to my system, in fact I was doing nothing at all other than reading a trusted page on the web).

I have looked into what a level 13 alert means, and according to this page, it means:

13 - Unusual error (high importance) - Most of the times it matches a common attack pattern.

So now I am rather concerned, I also do not know what the alert actually means (the one I was sent), so I do not know if this is an attack, or something else. So really I think that my question is now obvious, what does this mean, is it anything to worry about, and if so, then what is the recommended action?

---

OS Information:

Description:    Ubuntu 14.10
Release:    14.10

Answer 1

You must keep in mind that OSSEC isn't smart enough to accurately say what's going on based only on the text of the logged messages. You should analyse the log message yourself to find out its cause.

The notification you received says that OSSEC found a "Non standard syslog message" because of a "size too large" in /var/log/syslog. I can't say what makes a big message in syslog related somehow to "a common attack pattern", but I wouldn't care about it; OSSEC generates a lot of false positives. What you should do is to research what the message that generated the notification means.

Luckily, I've already seen this kind of message. "Modules linked in:" followed by a list of kernel modules usually happen when something related to kernel goes wrong and a call trace is generated. I found this on my syslog:

Apr 17 14:37:57 S6-STI-N04 kernel: [44610.494210] ------------[ cut here ]------------
Apr 17 14:37:57 S6-STI-N04 kernel: [44610.494257] WARNING: CPU: 0 PID: 0 at /build/buildd/linux-3.19.0/drivers/gpu/drm/i915/intel_display.c:9713 intel_check_page_flip+0xda/0xf0 [i915]()
Apr 17 14:37:57 S6-STI-N04 kernel: [44610.494259] Kicking stuck page flip: queued at 2514658, now 2514665
Apr 17 14:37:57 S6-STI-N04 kernel: [44610.494260] Modules linked in: ctr ccm rndis_host cdc_ether usbnet mii uas usb_storage nls_utf8 btrfs xor raid6_pq ufs qnx4 hfsplus hfs minix ntfs msdos jfs xfs libcrc32c cpuid pci_stub vboxpci(OE) vboxnetadp(OE) vboxnetflt(OE) vboxdrv(OE) binfmt_misc snd_hda_codec_hdmi i915 arc4 uvcvideo iwlmvm mac80211 videobuf2_vmalloc btusb intel_rapl videobuf2_memops iwlwifi iosf_mbi bluetooth x86_pkg_temp_thermal videobuf2_core intel_powerclamp v4l2_common videodev snd_hda_codec_realtek media snd_hda_codec_generic cfg80211 snd_hda_intel snd_hda_controller kvm_intel snd_hda_codec kvm snd_hwdep snd_pcm snd_seq_midi snd_seq_midi_event crct10dif_pclmul snd_rawmidi crc32_pclmul ghash_clmulni_intel snd_seq snd_seq_device dell_laptop snd_timer dell_wmi dcdbas snd aesni_intel aes_x86_64 soundcore sparse_keymap i8k lrw gf128mul drm_kms_helper glue_helper ablk_helper cryptd joydev 8250_fintek serio_raw shpchp drm mei_me dell_smo8800 wmi mei i2c_algo_bit lpc_ich video mac_hid coretemp parport_pc ppdev lp parport autofs4 e1000e ptp pps_core ahci psmouse sdhci_pci libahci sdhci
Apr 17 14:37:57 S6-STI-N04 kernel: [44610.494340] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G           OE  3.19.0-14-generic #14-Ubuntu
Apr 17 14:37:57 S6-STI-N04 kernel: [44610.494341] Hardware name: Dell Inc. Latitude E5440/078YP3, BIOS A10 12/18/2014
Apr 17 14:37:57 S6-STI-N04 kernel: [44610.494343]  ffffffffc0a9fe10 ffff88011ea03d28 ffffffff817c2205 0000000000000007
Apr 17 14:37:57 S6-STI-N04 kernel: [44610.494345]  ffff88011ea03d78 ffff88011ea03d68 ffffffff8107595a ffff88011ea03d88
Apr 17 14:37:57 S6-STI-N04 kernel: [44610.494348]  ffff880118f19000 ffff8800d97b8800 0000000000000000 ffff8800d97b89a8
Apr 17 14:37:57 S6-STI-N04 kernel: [44610.494351] Call Trace:
Apr 17 14:37:57 S6-STI-N04 kernel: [44610.494353]  <IRQ>  [<ffffffff817c2205>] dump_stack+0x45/0x57
Apr 17 14:37:57 S6-STI-N04 kernel: [44610.494370]  [<ffffffff8107595a>] warn_slowpath_common+0x8a/0xc0
Apr 17 14:37:57 S6-STI-N04 kernel: [44610.494372]  [<ffffffff810759d6>] warn_slowpath_fmt+0x46/0x50
Apr 17 14:37:57 S6-STI-N04 kernel: [44610.494390]  [<ffffffffc0a4ba3a>] intel_check_page_flip+0xda/0xf0 [i915]
Apr 17 14:37:57 S6-STI-N04 kernel: [44610.494411]  [<ffffffffc0a18948>] ironlake_irq_handler+0x2e8/0xfd0 [i915]
Apr 17 14:37:57 S6-STI-N04 kernel: [44610.494416]  [<ffffffff813bd824>] ? timerqueue_del+0x24/0x70
Apr 17 14:37:57 S6-STI-N04 kernel: [44610.494421]  [<ffffffff810956ff>] ? notifier_call_chain+0x4f/0x80
Apr 17 14:37:57 S6-STI-N04 kernel: [44610.494425]  [<ffffffff810cd5f7>] handle_irq_event_percpu+0x77/0x1a0
Apr 17 14:37:57 S6-STI-N04 kernel: [44610.494428]  [<ffffffff810cd761>] handle_irq_event+0x41/0x70
Apr 17 14:37:57 S6-STI-N04 kernel: [44610.494432]  [<ffffffff810d07ce>] handle_edge_irq+0x6e/0x120
Apr 17 14:37:57 S6-STI-N04 kernel: [44610.494435]  [<ffffffff81017772>] handle_irq+0x22/0x40
Apr 17 14:37:57 S6-STI-N04 kernel: [44610.494438]  [<ffffffff817cc27f>] do_IRQ+0x4f/0xf0
Apr 17 14:37:57 S6-STI-N04 kernel: [44610.494448]  [<ffffffff817ca0ed>] common_interrupt+0x6d/0x6d
Apr 17 14:37:57 S6-STI-N04 kernel: [44610.494449]  <EOI>  [<ffffffff816643d5>] ? cpuidle_enter_state+0x65/0x160
Apr 17 14:37:57 S6-STI-N04 kernel: [44610.494453]  [<ffffffff816643c1>] ? cpuidle_enter_state+0x51/0x160
Apr 17 14:37:57 S6-STI-N04 kernel: [44610.494456]  [<ffffffff816645b7>] cpuidle_enter+0x17/0x20
Apr 17 14:37:57 S6-STI-N04 kernel: [44610.494459]  [<ffffffff810b6a41>] cpu_startup_entry+0x311/0x3b0
Apr 17 14:37:57 S6-STI-N04 kernel: [44610.494463]  [<ffffffff817b6ad7>] rest_init+0x77/0x80
Apr 17 14:37:57 S6-STI-N04 kernel: [44610.494466]  [<ffffffff81d4cfce>] start_kernel+0x482/0x48f
Apr 17 14:37:57 S6-STI-N04 kernel: [44610.494469]  [<ffffffff81d4c120>] ? early_idt_handlers+0x120/0x120
Apr 17 14:37:57 S6-STI-N04 kernel: [44610.494472]  [<ffffffff81d4c4d7>] x86_64_start_reservations+0x2a/0x2c
Apr 17 14:37:57 S6-STI-N04 kernel: [44610.494474]  [<ffffffff81d4c61c>] x86_64_start_kernel+0x143/0x152
Apr 17 14:37:57 S6-STI-N04 kernel: [44610.494476] ---[ end trace 0b755d956a43fb36 ]---

As you can see in the second line, that chain of messages was caused by (a warning in) my GPU driver. I can't remember anything unusual back then. As my system didn't crash I think everything is OK.

You should search for "cut here" and "end trace" in your logs to find out what caused that message.

Answer 2

As Eric said, the level of the alert is just a classification and doesn't give you nearly the information you need to know to determine whether to be worried or not. For example, someone initially trying to hack an account through ssh will show up as a level 3 alert even though that could lead to something more serious. The text that follows the alert level is much more interesting.

Non standard syslog message (size too large).

Here's the actual rule:

<rule id="1003" level="13" maxsize="1025"> <description>Non standard syslog message (size too large).</description> </rule>

The line in your logfile is exceeding 1025 characters. In your case this doesn't look like a security issue. If you're getting a lot of these you can edit your config files to filter them out. The concern with long messages being sent to your logfiles is that it could indicate that someone is trying to attempt a buffer overrun attack by trying to request or send an excessively long URL to a web server. So it's all about context.