On this page

OSSEC / HIDS Rule 60334

OSSEC / HIDS rule catalog

  • Rule family: OSSEC / HIDS
  • Rule ID: 60334
  • Definition status: Present in current source
  • Alert message / subject: PaX: Crashing bruteforce prevention initiated
  • Rule level: 11
  • Definition checked: 2026-10-21

Interpretation and response

This event is recorded as “PaX: Crashing bruteforce prevention initiated”. Review the originating log and the affected host or service to determine whether the activity was expected.

An OSSEC/HIDS event records or correlates activity. Blocking depends on the originating application and any separately configured Active Response policy; an alert alone does not prove that an attack was blocked.

Documentation

The following guidance was migrated from the historical wiki and reviewed against the rule definition. Legacy ASL product names and interface instructions refer to the versions documented then. Use the current metadata above and your installed configuration when interpreting thresholds, notification settings and response behavior.

Description

This means an application may be trying to do something dangerous on your system and ASL is protecting you from this action. Please read this article for additional important information about this event.

Specifically, the ASL kernel protects your system by limiting attempts to bruteforce exploits against forking daemons such as apache or sshd, as well as against suid/sgid binaries will be deterred. When a child of a forking daemon is stopped by the ASL kernel because it has violated the kernel protection model or crashed due to an illegal instruction or other suspicious signal, the parent process will be delayed 30 seconds upon every subsequent fork until the administrator is able to assess the situation and restart the daemon. In the suid/sgid case, the attempt is logged, the user has all their processes terminated, and they are prevented from executing any further processes for 15 minutes. It is recommended that you also enable signal logging in the auditing section so that logs are generated when a process triggers a suspicious signal.

You should always investigate this event as it may be part of an actual attack on your system.

Note: Disabling this rule will not disable this protection, it will however tell ASL to not inform you of these events.

Log examples

Illustrative event summary (not a captured log): OSSEC/HIDS 60334 — PaX: Crashing bruteforce prevention initiated.

Troubleshooting

Solutions

Investigate the cause of the crash of the application, and if the crash was benign restart the application.

False Positives

False positive are not possible with this event. If you do not want to enable this optional protection, simply disable this setting:

ASL Configuration (historical reference)

Source and revision

Migrated from HIDS_60334, wiki page 639, revision 5540 (20150824). Documentation review: 2026-10-21. An archived wiki status of Active is not a current deployment status.

For assistance, provide the rule ID, installed product and rule version, and a sanitized event to Atomicorp support .