On this page
OSSEC / HIDS Rule 30221
- Rule family: OSSEC / HIDS
- Rule ID: 30221
- Definition status: Present in current source
- Alert message / subject: Multiple invalid Apache connection attempts - Possible DOS attack
- Rule level: 12
- Definition checked: 2026-10-21
- Configured frequency: 6
- Timeframe (seconds): 120
Correlation values are configuration attributes; event-count behavior depends on the manager version and parent rules.
Interpretation and response
This event is recorded as “Multiple invalid Apache connection attempts - Possible DOS attack”. Review the originating log and the affected host or service to determine whether the activity was expected.
An OSSEC/HIDS event records or correlates activity. Blocking depends on the originating application and any separately configured Active Response policy; an alert alone does not prove that an attack was blocked.
Documentation
The following guidance was migrated from the historical wiki and reviewed against the rule definition. Legacy ASL product names and interface instructions refer to the versions documented then. Use the current metadata above and your installed configuration when interpreting thresholds, notification settings and response behavior.
Description
This rule is triggered when Apache generates multiple errors from the same IP that it has received an invalid request form a client, and can not read the headers in the request.
These events are not triggered, caused, configured or managed by by ASL, and ASL does not cause the blocking action or alert. ASL simply reports that this error has occurred, and when Apache logs this error it has already rejected this request.
Details
This rule is designed to detect connections to Apache that Apache has rejected because it can not read the request headers. This can occur for one of two reasons:
1) This is an attack, and the client is attempt to cause Apache to crash or use up too many resources.
2) The client has generated a broken request.
ASL generates an alert for these conditions in case you wish to investigate further. Because there are known DOS attacks that generate these errors with Apache, ASL will track these events but will shun them.
ASL does not control or configure this behavior, it merely reports when this occurs with Apache. Therefore, if your clients are generating this error, please contact your Apache vendor, or the client to determine why they are generating these broken connections.
ASL will shun, by default, on these events. If you do not wish to have ASL block on these events please see the Tuning Advice section below.
Disabling this rule will not prevent Apache from blocking these requests, or generating these errors. It will simply “silence” the alert in ASL, however Apache will continue to reject these requests, and will continue to generate these errors. If this was a real DOS attack, ASL would not longer block the DOS attack. We do not recommend you disable this rule.
Troubleshooting
False Positives
This rule is not caused by ASL (historical reference). ASL merely reports when Apache generated this error.
Tuning Guidance
If you do not wish to shun on these alerts, just set Active Response in the ASL (historical reference) rule manager for rule 30221 to “no”.
Disabling this rule will not prevent Apache from dropping these connections. It will simply “silence” the alert in ASL. Apache will continue to drop these connections, and will continue to log this activity. We do not recommend you disable this rule.
Additional Information
Similar Rules
Source and revision
Migrated from HIDS_30221, wiki page 440, revision 3110 (20130119). Documentation review: 2026-10-21. An archived wiki status of Active is not a current deployment status.
For assistance, provide the rule ID, installed product and rule version, and a sanitized event to Atomicorp support .