Ignore systemd log warning Failed to reset devices.list: Operation not permitted in OSSEC

Maybe there are even more, depending what is installed.

These logs were found in all LXC containers of the new environment and were caused by this:

"Unprivileged containers cannot modify the devices cgroup configuration."

(found on https://github.com/lxc/lxd/issues/2004)

Yes, that makes sense and is actually expected behaviour. Although SystemD should be able to detect "i am running inside an unprivileged container; I cannot modify my own cgroup settings" and therefore should probably log something different, for now there is no "fix" for this problem.

Anyway, I wanted OSSEC to ignore such log entries. On the OSSEC server I adapted /var/ossec/rules/local_rules and added the following rule:

<!-- Added rule by Infiniroot: Ignore systemd warnings "Failed to reset devices.list" -->
<rule blob-code-marker-context"="" blob-code-inner="" id="<span class=">100101" level="0">
<if_sid>1002</if_sid>
<match>Failed to reset devices.list</match>
<description>Ignore systemd warnings "Failed to reset devices.list" inside containers.</description>
</rule>

The rule id is a unique ID of your own rule. To make sure you're not using an already used number, you have to use an ID between 100000 and 109999. This range is reserved for "user defined rules".
The if_sid field checks which rule actually created the alert. In the mail alert above you can see which rule was fired: 1002. That's the general rule to grep through syslogs and search for certain regular expressions.
Then in the match field you enter your regular expression. In this case I simply entered a full sentence "Failed to reset devices.list".
And finally in the description field you enter the description of that rule.

After an OSSEC server restart, the alerts were gone.

Anti Spam Question: Which famous ship sank in April 1912?