OSSEC / HIDS Rule 30155

OSSEC / HIDS rule catalog

• Rule family: OSSEC / HIDS
• Rule ID: 30155
• Definition status: Present in current source
• Alert message / subject: Multiple attempts to access a non-existent file.
• Rule level: 10
• Definition checked: 2026-10-21
• Configured frequency: 25
• Timeframe (seconds): 60

Correlation values are configuration attributes; event-count behavior depends on the manager version and parent rules.

Interpretation and response

This event is recorded as “Multiple attempts to access a non-existent file.” Review the originating log and the affected host or service to determine whether the activity was expected.

An OSSEC/HIDS event records or correlates activity. Blocking depends on the originating application and any separately configured Active Response policy; an alert alone does not prove that an attack was blocked.

The current rule explicitly disables Active Response for this event.

Documentation

The following guidance was migrated from the historical wiki and reviewed against the rule definition. Legacy ASL product names and interface instructions refer to the versions documented then. Use the current metadata above and your installed configuration when interpreting thresholds, notification settings and response behavior.

Description

ASL is reporting that a client has attempted to access a non-existent file, or files, multiple times via Apache. ASL does not cause this event, nor does it control this, it simply reports when Apache reports that this has happened.

Disabling this rule will have no effect on Apache returning a non-existent file error. Disabling this rule will simply cause ASL to no longer report when this occurs.

ASL will also not shun on this event, so there is no effect on the end user. The default threshold to trip this rule is 25 non-existent file accesses in 60 seconds. Multiple accesses to non-existent files may indicate an attacker is attempting to find a vulnerable piece of software, or other sensitive information on the system. We not recommend you disable this rule.

Troubleshooting

False Positives

None.

If you do not wish to be alerted to these events, simply disable the rule. This will have no effect on Apaches behavior, it simply means ASL will no longer report this event.

Tuning Guidance

To configure the firewall to allow connections to this port, please see the ASL firewall documentation page.

Source and revision

Migrated from HIDS_30155, wiki page 446, revision 4356 (20140102). Documentation review: 2026-10-21. An archived wiki status of Active is not a current deployment status.

For assistance, provide the rule ID, installed product and rule version, and a sanitized event to Atomicorp support .