Skip to content

Comments

Improve error message in ossec-testrule for missing rule matches#2170

Merged
atomicturtle merged 1 commit intoossec:mainfrom
atomicturtle:issue2093
Jan 23, 2026
Merged

Improve error message in ossec-testrule for missing rule matches#2170
atomicturtle merged 1 commit intoossec:mainfrom
atomicturtle:issue2093

Conversation

@atomicturtle
Copy link
Member

Changed cryptic error 'currently_rule not set!' to a more helpful message that explains what's actually wrong and how to fix it.

Old message:
'ossec-testrule: currently_rule not set!'

New message:
'ossec-testrule: No rule matched for decoder '<decoder_name>'.
Verify that rules exist for this decoder and check if rules have
required dependencies (if_sid, if_matched_sid, if_matched_group, etc.).'

This helps users quickly identify that:

  1. The decoder matched but no rule matched
  2. They should check if rules exist for this decoder
  3. Rules may be missing required dependencies like if_sid

Fixes issue #2093 reported by stefanct.

Changed cryptic error 'currently_rule not set!' to a more helpful message
that explains what's actually wrong and how to fix it.

Old message:
  'ossec-testrule: currently_rule not set!'

New message:
  'ossec-testrule: No rule matched for decoder '<decoder_name>'.
   Verify that rules exist for this decoder and check if rules have
   required dependencies (if_sid, if_matched_sid, if_matched_group, etc.).'

This helps users quickly identify that:
1. The decoder matched but no rule matched
2. They should check if rules exist for this decoder
3. Rules may be missing required dependencies like if_sid

Fixes issue ossec#2093 reported by stefanct.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant