Difference between revisions of "HIDS 11257"
(Created page with "'''Rule ID''' 11257 '''Status''' Active rule currently published. '''Description''' This rule is detects when proftp tries to connect to the antimalware daemon, clamd, and...") |
m |
||
| Line 2: | Line 2: | ||
11257 | 11257 | ||
| + | |||
'''Status''' | '''Status''' | ||
Latest revision as of 21:33, 20 December 2011
Rule ID
11257
Status
Active rule currently published.
Description
This rule is detects when proftp tries to connect to the antimalware daemon, clamd, and can not do this. These means the antimalware daemon is not running, or something is preventing the FTP daemon from talking to it.
Check to make sure clamd is running. Log into the ASL GUI and check that CLAMAV_ENABLED is set to yes.
False Positives
There is no known false positive for this rule.
If you believe that this is a false positive, please report this to our security team can determine if this is a legitimate case, or if its clever attack on your system. Instructions to report false positives are detailed on the Reporting False Positives wiki page.
Tuning Recommendations
None.
Similar Rules
None.
Knowledge Base Articles
None.
Outside References
