OSSEC / HIDS Rule 31102

OSSEC / HIDS rule catalog

• Rule family: OSSEC / HIDS
• Rule ID: 31102
• Definition status: Present in current source
• Alert message / subject: Possible DoS Consumption Attack
• Rule level: 10
• Definition checked: 2026-10-21

Interpretation and response

This event is recorded as “Possible DoS Consumption Attack”. Review the originating log and the affected host or service to determine whether the activity was expected.

An OSSEC/HIDS event records or correlates activity. Blocking depends on the originating application and any separately configured Active Response policy; an alert alone does not prove that an attack was blocked.

Documentation

The following guidance was migrated from the historical wiki and reviewed against the rule definition. Legacy ASL product names and interface instructions refer to the versions documented then. Use the current metadata above and your installed configuration when interpreting thresholds, notification settings and response behavior.

Description

This rule is triggered when a a single IP has opened too many connections to the apache webserver in a READ state. This condition is unusual for a normal client, and occurs when either an attacker is trying to use up all the threads on the server to prevent it from servicing any other clients (Denial of Service Attack) or if a single IP needs to open an unusually high number of READ connections.

This alert will also occur when a slowloris attack is occurring.

This rule reports when apache has stopped accepting READ requests from a client. You can configure this limit by following the Tuning Guidance below.

Log example

[warn] ModSecurity: Access denied with code 400. Too many threads [11] of 10 allowed in READ state from 192.0.2.10 - Possible DoS Consumption Attack [Rejected

Troubleshooting

False Positives

The rule alerts when the configured WAF_READSTATELIMIT value is exceeded. The rule does not cause this event to occur, it just reports when it occurs.

Disabling this rule will not prevent this event from occurring, it will just prevent ASL from alerting you that this is occurring.

We do not recommend you disable this rule. If you do not wish to shun on this rule, just change the Rules configuration for Active Response to “no”. See below for tuning guidance if the default READ state limit is too low for your system.

Tuning Guidance

This limit is configured by this setting:

ASL WAF (historical reference)

Increasing this limit may make your system vulnerable to slowloris attacks. Setting this too low may cause legitimate clients from being able to connect to your system.

Additional Information

Notes

The default limit in ASL3 is 10, the default limit in ASL4 is 100. ASL4 contains additional safeguards against Denial of Service attacks and can safely allow a higher limit without a decrease in protection.

Source and revision

Migrated from HIDS_31102, wiki page 480, revision 4453 (20140125). Documentation review: 2026-10-21. An archived wiki status of Active is not a current deployment status.

For assistance, provide the rule ID, installed product and rule version, and a sanitized event to Atomicorp support .