OSSEC / HIDS Rule 592

OSSEC / HIDS rule catalog

• Rule family: OSSEC / HIDS
• Rule ID: 592
• Definition status: Present in current source
• Alert message / subject: Log file size reduced.
• Rule level: 8
• Definition checked: 2026-10-21

Interpretation and response

This event is recorded as “Log file size reduced.” Review the originating log and the affected host or service to determine whether the activity was expected.

An OSSEC/HIDS event records or correlates activity. Blocking depends on the originating application and any separately configured Active Response policy; an alert alone does not prove that an attack was blocked.

Documentation

The following guidance was migrated from the historical wiki and reviewed against the rule definition. Legacy ASL product names and interface instructions refer to the versions documented then. Use the current metadata above and your installed configuration when interpreting thresholds, notification settings and response behavior.

Rule ID

592

Status

The wiki marked this rule Active at the source revision. Current definition status is shown above.

Description

This rule detects when a monitored file changes. This may be an authorized change, or an unauthorized change and these changes should be investigated further.

Specifically this rule detects if a files size has been reduced, but has not been replaced. This can occur if an attacker has removed lines from the log file, if an attacker has “zeroed” out the log file, or if a non-malicious process has zeroed out the log file.

Some log rotation tools may do this, instead of moving the file.

False Positives

A legitimate event may still trigger this rule. Review the surrounding activity before deciding whether it is malicious. This rule detects when files change, therefore, it is not recommended that you disable this rule. Instead, if you do not wish to be alerted when a specific file or files in a particular directory change, please log into the ASL GUI, click on the ASL tab, select the File Integrity menu options and modify your configuration to ignore this file or directory.

Tuning Recommendations

If you do not wish to monitor the file or directory reported as changed, log into the ASL GUI, click on the ASL tab, select the File Integrity menu options and modify your configuration to ignore this file or directory.

Source and revision

Migrated from HIDS_592, wiki page 413, revision 2819 (20121020). Documentation review: 2026-10-21. An archived wiki status of Active is not a current deployment status.

For assistance, provide the rule ID, installed product and rule version, and a sanitized event to Atomicorp support .