On this page

OSSEC / HIDS Rule 171010

OSSEC / HIDS rule catalog

  • Rule family: OSSEC / HIDS
  • Rule ID: 171010
  • Definition status: Present in current source
  • Alert message / subject: Multiple Rejected MAIL: Access Denied in 30 seconds from the same source.
  • Rule level: 7
  • Definition checked: 2026-10-21
  • Configured frequency: 6
  • Timeframe (seconds): 30

Correlation values are configuration attributes; event-count behavior depends on the manager version and parent rules.

Interpretation and response

This event is recorded as “Multiple Rejected MAIL: Access Denied in 30 seconds from the same source.” Review the originating log and the affected host or service to determine whether the activity was expected.

An OSSEC/HIDS event records or correlates activity. Blocking depends on the originating application and any separately configured Active Response policy; an alert alone does not prove that an attack was blocked.

Documentation

The following guidance was migrated from the historical wiki and reviewed against the rule definition. Legacy ASL product names and interface instructions refer to the versions documented then. Use the current metadata above and your installed configuration when interpreting thresholds, notification settings and response behavior.

Description

ASL does not cause this event to occur. ASL simply reports when it occurs.

This means that exim has rejected a mail connection, and has done so 8 or more times within 30 seconds, from the same IP.

Log examples

Illustrative event summary (not a captured log): OSSEC/HIDS 171010 — Multiple Rejected MAIL: Access Denied in 30 seconds from the same source..

Troubleshooting

Solutions

ASL does not cause this event to occur. ASL simply reports when it occurs. Disabling this rule will not prevent exim from blocking these connections, disabling this rule will only silence this alert. Exim is causing these blocks, and only configuring Exim will change this behavior of Exim. ASL does not manage or configure Exim. Please contact your mail server vendor for assistance if you do not know how to configure Exim, or contact our sales department and we can put a professional services quote together to assist you.

If you wish to prevent ASL from shunning on these events, simply set Active Response for the rule to off. This will of course not stop Exim from blocking these connections.

False Positives

None. Please do not report this as a false positive unless ASL is incorrectly reporting an event that is:

1) not exim

or

2) exim is not rejecting the connection

Additional Information

External Articles

None.

Source and revision

Migrated from HIDS_171010, wiki page 547, revision 5087 (20140905). Documentation review: 2026-10-21. An archived wiki status of Active is not a current deployment status.

For assistance, provide the rule ID, installed product and rule version, and a sanitized event to Atomicorp support .