OSSEC / HIDS Rule 30195

OSSEC / HIDS rule catalog

• Rule family: OSSEC / HIDS
• Rule ID: 30195
• Definition status: Present in current source
• Alert message / subject: Multiple access forbidden file or directory events from the same IP.
• Rule level: 10
• Definition checked: 2026-10-21
• Configured frequency: 10
• Timeframe (seconds): 60

Correlation values are configuration attributes; event-count behavior depends on the manager version and parent rules.

Interpretation and response

This event is recorded as “Multiple access forbidden file or directory events from the same IP.” Review the originating log and the affected host or service to determine whether the activity was expected.

An OSSEC/HIDS event records or correlates activity. Blocking depends on the originating application and any separately configured Active Response policy; an alert alone does not prove that an attack was blocked.

The current rule explicitly disables Active Response for this event.

Documentation

The following guidance was migrated from the historical wiki and reviewed against the rule definition. Legacy ASL product names and interface instructions refer to the versions documented then. Use the current metadata above and your installed configuration when interpreting thresholds, notification settings and response behavior.

Description

This rule is triggered when ASL has detected that your web server has forbidden access to a file or directory for a single IP address multiple times. This rule is triggered if this occurs 10 or more times within 60 seconds.

This event is not triggered, caused, configured or managed by ASL. ASL is simply reporting that your web server is blocking access to this file or directory.

Details

This rule is designed to detect when your web server has prevented access to a file or directory and this event has occurred multiple times from a single IP address within a short period of time (60 seconds). This can occur if the web server is configured to prevent access to this file or directory, or if the permissions on the directory or file do not allow access by the web server.

ASL does not control or cause this behavior, it merely reports when this occurs. If your web server is denying access to a file or directory, please contact your web server vendor for assistance with this issue.

ASL does not block and will not shun, by default, on these events however if you wish to have ASL shun an IP address on these events please see the Tuning Advice section below.

Disabling this rule will not prevent your web server from preventing access to this file or directory. It will simply “silence” the alert in ASL, however your web server will continue to deny access to the file or directory. We do not recommend you disable this rule.

Troubleshooting

False Positives

This rule is not caused by ASL (historical reference). ASL merely reports when your web server blocks access to a file or directory

Tuning Guidance

If you wish to shun on these alerts, just set Active Response in the ASL (historical reference) rule manager for rule 30105 to “yes”.

Disabling this rule will not prevent your web server from denying access to the file or directory. It will simply “silence” the alert in ASL. Your web server will continue to alert and/or block this activity. We do not recommend you disable this rule.

If you do not wish to see this alert, just set it to a lower level that the default in the ASL gui.

If you do not wish to be emailed on this alert, just set the rule to not email.

Additional Information

Example log messages

[error] [client 192.0.2.10] client denied by server configuration: /home/user/public_html/favicon.ico

Source and revision

Migrated from HIDS_30195, wiki page 642, revision 5573 (20151007). Documentation review: 2026-10-21. An archived wiki status of Active is not a current deployment status.

For assistance, provide the rule ID, installed product and rule version, and a sanitized event to Atomicorp support .