On this page

OSSEC / HIDS Rule 30114

OSSEC / HIDS rule catalog

  • Rule family: OSSEC / HIDS
  • Rule ID: 30114
  • Definition status: Present in current source
  • Alert message / subject: mod_qos invalid request detected
  • Rule level: 6
  • Definition checked: 2026-10-21

Interpretation and response

This event is recorded as “mod_qos invalid request detected”. Review the originating log and the affected host or service to determine whether the activity was expected.

An OSSEC/HIDS event records or correlates activity. Blocking depends on the originating application and any separately configured Active Response policy; an alert alone does not prove that an attack was blocked.

Documentation

The following guidance was migrated from the historical wiki and reviewed against the rule definition. Legacy ASL product names and interface instructions refer to the versions documented then. Use the current metadata above and your installed configuration when interpreting thresholds, notification settings and response behavior.

Description

This rule is triggered when a third party QOS system, specially mod_qos, has reported an event that it has blocked. Specifically if mod_qos has blocked an invalid request.

These events are not triggered, caused, configured or managed by by ASL, and ASL does not cause the blocking action or alert. The Third Party IDS is the cause of this event.

ASL will shun on this event by default.

Details

This rule is designed to detect the third party mod_qos event and to alert when it has blocked an invalid connection.

ASL does not control or configure mod_qos, it merely reports when this occurs. Therefore, if your mod_qos is in error, please contact the vendor that installed mod_qos for assistance with configuring it.

Disabling this rule will not prevent mod_qos blocking this activity. It will simply “silence” the alert in ASL, and prevent ASL from shunning this event. However mod_qos will continue to block this activity. We do not recommend you disable this rule.

Troubleshooting

False Positives

None.

Tuning Guidance

If you do not wish to shun on these alerts, just set Active Response in the ASL (historical reference) rule manager for rule 30114 to “no”.

Source and revision

Migrated from HIDS_30114, wiki page 509, revision 4464 (20140204). Documentation review: 2026-10-21. An archived wiki status of Active is not a current deployment status.

For assistance, provide the rule ID, installed product and rule version, and a sanitized event to Atomicorp support .