Ticket #42533: local_rules_mac.xml

File local_rules_mac.xml, 22.7 KB (added by jul_bsd@…, 11 years ago)
Line 
1<!-- @(#) $Id: ./etc/rules/local_rules_mac.xml, 2011/09/08 dcid Exp $
2
3  -  Rules for a MacOS X (10.9)
4  -
5  -->
6
7
8<!-- Modify it at your will. -->
9
10  <!-- Some "Classical" messages we ignore -->
11
12<group name="syslog,itunes">
13  <rule id="102001" level="0">
14<!--
15    <match>Could not securely send message size</match> OK/OK
16    <regex>_send_message \(thread 0x[0-9a-f]+\): Could not securely send message size \d+: SSL_ERROR_SYSCALL errno (Broken pipe).</regex> OK/NOK
17    <regex>_send_message \(thread 0x[0-9a-f]+\): Could not securely send message size \d+: SSL_ERROR_SYSCALL errno \(Broken pipe\).</regex> OK/NOK
18    <regex>_send_message \(thread 0x[0-9a-f].+\): Could not securely send message size \d+: SSL_ERROR_SYSCALL errno \(Broken pipe\).</regex> OK/NOK
19    <regex>_send_message (thread 0x\w+): Could not securely send message size \d+: SSL_ERROR_SYSCALL errno (Broken pipe).</regex> OK/NOK
20    <regex>_send_message \(thread 0x.+\): Could not securely send message size \d+: SSL_ERROR_SYSCALL errno \(Broken pipe\).</regex> OK/NOK
21-->
22    <match>Could not securely send message size </match>
23    <description>iTunes log noise</description>
24  </rule>
25 
26  <rule id="102002" level="0">
27<!--
28    <regex>AMDeviceStopSession (thread 0x\w+): Could not stop session with device \d+: kAMDSendMessageError</regex>
29    <regex>AMDeviceStopSession \(thread 0x[0-9a-f]+\): Could not stop session with device \d+: kAMDSendMessageError</regex>
30    <match>Could not stop session with device</regex>
31-->
32    <match>Could not stop session with device </match>
33    <description>iTunes log noise</description>
34  </rule>
35</group>
36
37<group name="syslog,com.apple.appkit.xpc.openAndSavePanelService,">
38  <rule id="102003" level="0">
39<!-- Error: ossec-analysisd(1450): ERROR: Syntax error on regex: '' 6
40    <regex>com.apple.appkit.xpc.openAndSavePanelService\[\d+\]: ERROR: CGSSetWindowTransformAtPlacement returned \d+</regex>
41    <regex>com.apple.appkit.xpc.openAndSavePanelService\[\d+\]: ERROR: CGSSetWindowTransformAtPlacement returned (\d+)</regex>
42    <regex>com.apple.appkit.xpc.openAndSavePanelService[\d+]: ERROR: CGSSetWindowTransformAtPlacement returned \d+</regex>
43    <regex>com.apple.appkit.xpc.openAndSavePanelService\[.+\]: ERROR: CGSSetWindowTransformAtPlacement returned</regex>
44    <regex>com.apple.appkit.xpc.openAndSavePanelService\[\d+\]: </regex>
45-->
46    <regex>com.apple.appkit.xpc.openAndSavePanelService</regex>
47    <description>apple.appkot.xpc log noise</description>
48  </rule>
49 
50  <rule id="102004" level="0">
51<!-- Error: ossec-analysisd(1450): ERROR: Syntax error on regex: '' 6
52    <regex>com.apple.appkit.xpc.openAndSavePanelService\[\d+\]: CGSSetWindowTransformAtPlacement: Failed</regex>
53-->
54    <match>CGSSetWindowTransformAtPlacement: Failed</match>
55    <description>apple.appkot.xpc log noise</description>
56  </rule>
57  <rule id="102005" level="0">
58    <match>ERROR: CGSSetWindowTransformAtPlacement() returned 1001</match>
59    <description>apple.appkot.xpc log noise</description>
60  </rule>
61</group>
62 
63<group name="syslog,console,">
64  <rule id="102008" level="0">
65    <match>Metadata.framework [Error]: void _MDItemMarkAsUsedForPath(CFStringRef): was called with a NULL path</match>
66    <description>Console log noise</description>
67  </rule>
68</group>
69 
70<group name="syslog,">
71  <rule id="102009" level="0">
72<!--
73    <regex>assertion failed: [0-9A-F]+: xpcproxy \+ \d+ \[[0-9A-F]+\]: 0x[0-9a-f]+</regex>
74-->
75    <match>assertion failed: </match>
76    <description>general log noise: assertion failed</description>
77  </rule>
78  <rule id="102010" level="6">
79    <match>All available displays report that they are mirrors.  This seems wrong.  Please comment in \<rdar://problem/14731307\> if you see this log</match>
80    <description>Apple Bug with window</description>
81  </rule>
82</group>
83 
84<group name="syslog,iptables,">
85  <rule id="110000" level="7">
86    <if_sid>5100</if_sid>
87    <decoded_as>usb-insert</decoded_as>
88    <description>USB device app group.</description>
89  </rule>
90  <rule id="110001" level="5">
91    <match>AirPort_Brcm43xx::powerChange: System Sleep</match>
92    <description>System going to sleep (wifi card)</description>
93  </rule>
94<!--
95  <rule id="110002" level="5">
96    <regex>\[0x[0-9a-f]+, 0x[0-9a-f]+\]</regex>
97    <description>System useless log noise</description>
98  </rule>
99-->
100  <rule id="110003" level="5">
101    <match>Wake reason: EC LID0</match>
102    <description>System: Waking up (lid opened)</description>
103  </rule>
104  <rule id="110004" level="2">
105    <match>memorystatus_thread: idle exiting pid</match>
106    <description>System: memorystatus_thread: idle exiting pid</description>
107  </rule>
108  <!-- normal rule: FIXME! catch everything, whatever being before or after the two exceptions rules -->
109<!--
110  <rule id="110005" level="7">
111    <match>CODE SIGNING: cs_invalid_page(0x1000): </match>
112    <description>System: Code signing error</description>
113  </rule>
114-->
115  <!-- Google software: chrome & the like not signed it seems (or not everything)
116        https://discussions.apple.com/message/24570797#24570797
117-->
118  <rule id="110006" level="6">
119<!-- NOK???
120    <regex>CODE SIGNING: cs_invalid_page\(0x1000\): p=\d+[GoogleSoftwareUp] final status 0x0, allowing \(remove VALID\)</regex>
121    <regex>[GoogleSoftwareUp] final status 0x0, allowing \(remove VALID\)</regex>
122    <match>[GoogleSoftwareUp] final status 0x0, allowing (remove VALID)</match>
123    <match>[GoogleSoftwareUp] final status 0x0, allowing</match>
124    <match>\[GoogleSoftwareUp\] final status 0x0, allowing</match>
125OK
126    <regex>\.GoogleSoftwareUp\. final status 0x0, allowing</regex>
127-->
128    <regex>CODE SIGNING: cs_invalid_page\(0x1000\): p=\d+\.GoogleSoftwareUp\. final status 0x0, allowing \(remove VALID\)</regex>
129    <description>System: Code signing error - GoogleSoftwareUp</description>
130  </rule>
131  <rule id="110007" level="6">
132    <regex>CODE SIGNING: cs_invalid_page\(0x1000\): p=\d+\.ksadmin\. final status 0x0, allowing \(remove VALID\)</regex>
133    <description>System: Code signing error - Google ksadmin</description>
134  </rule>
135</group>
136
137<group name="syslog,launchd,">
138  <rule id="103000" level="0">
139    <match>assertion failed: </match>
140    <description>launchd log noise: assertion failed</description>
141  </rule>
142  <rule id="103001" level="5">
143    <match>Background: Aqua: Registering new GUI session.</match>
144    <description>Restarted Aqua session???</description>
145  </rule>
146  <rule id="103002" level="5">
147    <match>Job appears to have crashed: </match>
148    <description>launchd: some apps crashed</description>
149  </rule>
150</group>
151
152<group name="syslog,secd,">
153  <rule id="103010" level="0">
154<!-- https://discussions.apple.com/message/23571041#23571041 ? -->
155<!--
156    <match>SecErrorGetOSStatus unknown error domain: com.apple.security.sos.error for error: The operation couldn't be completed.</match> NOK
157-->
158    <match>SecErrorGetOSStatus unknown error domain: com.apple.security.sos.error for error: The operation couldn</match>
159    <options>no_email_alert</options>
160    <description>secd log noise: (keychain error???)</description>
161  </rule>
162  <rule id="103011" level="0">
163    <match>securityd_xpc_dictionary_handler WiFiKeychainProx</match>
164    <description>secd log noise: (wifi error???)</description>
165  </rule>
166  <rule id="103012" level="0">
167<!--
168    <match>securityd_xpc_dictionary_handler EscrowSecurityAl[20289] DeviceInCircle The operation couldn’t be completed. (com.apple.security.sos.error error 2 - Public Key not available - failed to register before call)</match>
169-->
170    <match>be completed. (com.apple.security.sos.error error 2 - Public Key not available - failed to register before call)</match>
171    <description>secd log noise</description>
172  </rule>
173</group>
174
175<group name="syslog,SecurityServer,">
176  <rule id="102020" level="4">
177    <match>created</match>
178    <description>SecurityServer: Session created</description>
179  </rule>
180  <rule id="102021" level="4">
181    <match>destroyed</match>
182    <description>SecurityServer: Session destroyed</description>
183  </rule>
184</group>
185
186<group name="syslog,loginwindow,">
187  <rule id="102030" level="5">
188    <match>ERROR | -[LWBuiltInScreenLockAuthLion askForPasswordBuiltIn:] | Attempted to add an observer when already observing</match>
189    <description>SecurityServer: Session created</description>
190  </rule>
191</group>
192
193<group name="syslog,usernoted,">
194  <rule id="102040" level="3">
195    <match>Connection does not have the proper entitlement (com.apple.developer.notificationcenter-identifiers) to connect on behalf of com.apple.appstore. All communication will be denied.</match>
196    <description>usernoted?</description>
197  </rule>
198</group>
199
200<group name="syslog,universalaccessd,">
201  <rule id="102050" level="0">
202    <match>CGSConnectionByID: 0 is not a valid connection ID.</match>
203    <description>universalaccessd log noise</description>
204  </rule>
205  <rule id="102051" level="0">
206    <match>CGSSetHotKeyEnabled: Invalid connection</match>
207    <description>universalaccessd log noise</description>
208  </rule>
209</group>
210<group name="syslog,">
211  <rule id="103020" level="0">
212<!--
213    <match>XPC error messaging com.apple.IconServicesAgent: Connection interrupted</match>
214    <regex>XPC error messaging com.apple.IconServicesAgent: Connection (interrupted|invalid)</regex>    NOK
215-->
216    <match>XPC error messaging com.apple.IconServicesAgent: Connection interrupted</match>
217    <description>xpc messaging error</description>
218  </rule>
219  <rule id="103021" level="0">
220    <match>XPC error messaging com.apple.IconServicesAgent: Connection invalid</match>
221    <description>xpc messaging error</description>
222  </rule>
223<!-- appstore.log noise
224                "XPCErrorDescription" => <string: 0x7fff75dbfe60> { length = 18, contents = "Connection invalid" }
225-->
226  <rule id="103031" level="2">
227    <match>"XPCErrorDescription" => \<string: </match>
228    <description>appstore.log noise: XPCErrorDescription</description>
229  </rule>
230</group>
231
232<group name="syslog,storeagent,">
233  <rule id="102060" level="0">
234    <match>AutoUpdateOperation: Skipping purchase of update jp.ogihara.typist because it previously failed to auto-update with the same reason as it would fail now (501) (userInitiated=0, shouldCheckForAndStageAppUpdates=0)</match>
235    <description>storeagent?</description>
236  </rule>
237</group>
238
239<group name="syslog,appleeventsd,">
240  <rule id="102070" level="0">
241<!--
242    <match>\<rdar://problem/11489077\> A sandboxed application with pid</match>
243-->
244    <match>checked in with appleeventsd, but its code signature could not be validated ( either because it was corrupt, or could not be read by appleeventsd ) and so it cannot receive AppleEvents targeted by name, bundle id, or signature. Error=ERROR: </match>
245    <description>appleevents: sandbox problem?</description>
246  </rule>
247</group>
248
249<group name="syslog,com.apple.authd,">
250  <rule id="102080" level="0">
251    <match>Succeeded authorizing right</match>
252    <description>com.apple.authd: Succeeded authorizing right</description>
253  </rule>
254</group>
255
256<group name="syslog,preview,">
257  <rule id="130000" level="0">
258    <match>It does not make sense to draw an image when [NSGraphicsContext currentContext] is nil.  This is a programming error. Break on void _NSWarnForDrawingImageWithNoCurrentContext() to debug.  This will be logged only once.  This may break in the future.</match>
259    <description>Preview log noise</description>
260  </rule>
261  <rule id="130001" level="0">
262    <match>Failure to de-serialize bookmark data file</match>
263    <description>Preview log noise</description>
264  </rule>
265<!--
266Mar  7 15:05:38 HOST Preview[8520]: view service marshal for <NSRemoteView: 0x7f9d61e84ba0> failed to forget accessibility connection due to Error Domain=NSCocoaErrorDomain Code=4099 "Impossible de communiquer avec un utilitaire." (The connection was invalidated from this process.) UserInfo=0x7f9d61dc7170 {NSDebugDescription=The connection was invalidated from this process.}
267        timestamp: 15:05:38.126 Friday 07 March 2014
268        process/thread/queue: Preview (8520) / 0x110293000 / com.apple.NSXPCConnection.user.endpoint
269        code: line 2972 of /SourceCache/ViewBridge/ViewBridge-46.2/NSRemoteView.m in __57-[NSRemoteView viewServiceMarshalProxy:withErrorHandler:]_block_invoke
270        domain: communications-failure
271
272
273-->
274  <rule id="130002" level="0">
275    <match>failed to forget accessibility connection due to Error Domain=NSCocoaErrorDomain Code=4099</match>
276    <description>Preview log noise</description>
277  </rule>
278  <rule id="130003" level="0">
279    <match>process/thread/queue: Preview</match>
280    <description>Preview log noise</description>
281  </rule>
282  <rule id="130004" level="0">
283    <match>code: line 2972 of /SourceCache/ViewBridge/ViewBridge-46.2/NSRemoteView.m in __57-[NSRemoteView viewServiceMarshalProxy:withErrorHandler:]_block_invoke</match>
284    <description>Preview log noise</description>
285  </rule>
286  <rule id="130005" level="0">
287    <match>domain: communications-failure</match>
288    <description>Preview log noise</description>
289  </rule>
290</group>
291
292<group name="syslog,iconservices,">
293  <rule id="100401" level="0">
294    <match>Error: Failed to add value to tree: Invalid node at index:</match>
295    <description>IconServices log noise</description>
296  </rule>
297  <rule id="100402" level="0">
298    <match>main Failed to composit image for binding VariantBinding</match>
299    <description>IconServices log noise</description>
300  </rule>
301</group>
302
303<group name="syslog,speechrecognition,">
304  <rule id="100501" level="0">
305    <match>DSX Error 9: ParamSetStringValue("EnxRescoringRulesCall","-1")</match>
306    <description>Speech recognition log noise</description>
307  </rule>
308  <rule id="100502" level="0">
309<!--
310    <match>S2: Error: cannot open preference file '/System/Library/Speech/Recognizers/SpeechRecognitionCoreLanguages/fr_FR.SpeechRecognition/Contents/Resources/config/s2/server/1shot/si/server.ini': Read error.</match> OK/NOK
311-->
312    <match>S2: Error: cannot open preference file </match>
313    <description>Speech recognition log noise</description>
314  </rule>
315  <rule id="100503" level="0">
316    <match>DSX Error 102: DSXFileSystem_CreateAcousticsWithFlags(fFileSystem, kSpeaker, "voice", baseModel, DSXCreateAcoustics_Sig)</match>
317    <description>Speech recognition log noise</description>
318  </rule>
319  <rule id="100504" level="0">
320    <match>S2: Loading Flavor </match>
321    <description>Speech recognition log noise</description>
322  </rule>
323</group>
324
325<group name="syslog,UserEventAgent,">
326  <rule id="100601" level="0">
327    <match>Failed to copy info dictionary for bundle /System/Library/UserEventPlugins/alfUIplugin.plugin</match>
328    <description>UserEventAgent log noise</description>
329  </rule>
330</group>
331
332<group name="syslog,SecurityAgent,">
333  <rule id="100701" level="0">
334    <match>CGError CGSGetDisplaySystemState(uint64_t, CGSDisplaySystemState **): MIG error</match>
335    <description>SecurityAgent log noise</description>
336  </rule>
337</group>
338
339<group name="syslog,WindowServer,">
340  <rule id="100801" level="5">
341    <regex>Session \d+ retained (\d+ references)</regex>
342    <description>WindowServer: suspending/locking/waking up???</description>
343  </rule>
344  <rule id="100802" level="5">
345    <regex>Session \d+ released (\d+ references)</regex>
346    <description>WindowServer: suspending/locking/waking up???</description>
347  </rule>
348  <rule id="100803" level="0">
349<!--
350    <match>CGError post_notification(const CGSNotificationType, void *const, const size_t, const bool, const CGSRealTimeDelta, const int, const CGSConnectionID *const, const pid_t): Timed out 1.000 second wait for reply from "Google Chrome" for synchronous notification type 102 (kCGSDisplayWillSleep)</match>
351    <regex>CGError post_notification(const CGSNotificationType, void *const, const size_t, const bool, const CGSRealTimeDelta, const int, const CGSConnectionID *const, const pid_t): Timed out [0-9.]+ second wait for reply from ".+" for synchronous notification type 102 (kCGSDisplayWillSleep)</regex>
352-->
353    <match>CGError post_notification(const CGSNotificationType, void *const, const size_t, const bool, const CGSRealTimeDelta, const int, const CGSConnectionID *const, const pid_t): Timed out </match>
354    <description>WindowServer: suspending/locking on application???</description>
355  </rule>
356  <rule id="100804" level="0">
357    <match>Failed setting the front application to</match>
358    <description>WindowServer: Failed setting the front application</description>
359  </rule>
360</group>
361
362<group name="syslog,usbmuxd,">
363  <rule id="101001" level="0">
364    <match>DeviceRequestAsync failed:</match>
365    <description>usbmuxd log noise</description>
366  </rule>
367</group>
368
369<group name="syslog,ManagedClient,">
370  <rule id="101021" level="0">
371    <match>MCX.createConnection bootstrap_register failed = 1100</match>
372    <description>ManagedClient log?</description>
373  </rule>
374</group>
375
376<group name="syslog,mds,">
377  <rule id="101031" level="0">
378    <match>(Normal) ImportServer: Ignoring blacklisted Spotlight importer plugin:</match>
379    <description>mds/spotlight: ignoring some importer plugin</description>
380  </rule>
381  <rule id="101032" level="3">
382    <match>(Error) Import: sandbox_extension_issue_file: 2</match>
383    <description>mds/spotlight: sandbox_extension_issue_file</description>
384  </rule>
385</group>
386
387<group name="syslog,fsevents,">
388  <rule id="101041" level="0">
389<!--
390Mar  2 08:57:06 HOST fseventsd[42]: SLOWDOWN: client 0x7fe9c3038000 (pid 21063) sleeping due to too many errors (num usleeps 5859)
391=> FIXME/BUG: match 101031 ???
392-->
393    <match>sleeping due to too many errors (num usleeps </match>
394    <description>mds/spotlight: ignoring some importer plugin</description>
395  </rule>
396</group>
397
398<group name="syslog,ReportCrash,">
399  <rule id="101051" level="0">
400    <match>Metadata.framework [Error]: couldn't get the client port</match>
401    <description>ReportCrash error</description>
402  </rule>
403</group>
404
405<group name="syslog,com.apple.internetaccounts,">
406  <rule id="101061" level="0">
407<!--
408com.apple.internetaccounts[6930]: An instance 0x7ffe51729420 of class IMAPMailbox was deallocated while key value observers were still registered with it. Observation info was leaked, and may even become mistakenly attached to some other object. Set a breakpoint on NSKVODeallocateBreak to stop here in the debugger. Here's the current observation info:
409        <NSKeyValueObservationInfo 0x7ffe5168f730> (
410        <NSKeyValueObservance 0x7ffe5168f880: Observer: 0x7ffe51685770, Key path: uidNext, Options: <New: NO, Old: NO, Prior: NO> Context: 0x7fff8efca43b, Property: 0x7ffe5168f700>
411        )
412-->
413    <match>of class IMAPMailbox was deallocated while key value observers were still registered with it. Observation info was leaked, and may even become mistakenly attached to some other object. Set a breakpoint on NSKVODeallocateBreak to stop here in the debugger. Here's the current observation info:</match>
414    <description>com.apple.internetaccounts: deallocation/leak (part1 - multiline)</description>
415  </rule>
416  <rule id="101062" level="0">
417    <match>NSKeyValueObservationInfo</match>
418    <description>com.apple.internetaccounts: deallocation/leak (part2 - multiline)</description>
419  </rule>
420  <rule id="101063" level="0">
421    <match>NSKeyValueObservance </match>
422    <description>com.apple.internetaccounts: deallocation/leak (part3 - multiline)</description>
423  </rule>
424</group>
425
426<group name="syslog,com.apple.imfoundation.IMRemoteURLConnectionAgent,">
427  <rule id="101071" level="1">
428<!--
429Mar  7 16:20:37 HOST com.apple.imfoundation.IMRemoteURLConnectionAgent[12644]: ERROR: __CFURLCache:CreateTablesAndIndexes version create - disk I/O error. ErrCode: 10.
430-->
431    <match>ERROR: __CFURLCache:CreateTablesAndIndexes version create - disk I/O error. ErrCode: 10.</match>
432    <description>com.apple.imfoundation.IMRemoteURLConnectionAgent: disk I/O error</description>
433  </rule>
434  <rule id="101072" level="1">
435<!--
436Mar  7 16:20:37 HOST com.apple.imfoundation.IMRemoteURLConnectionAgent[12644]: __CFURLCache:RecreateEmptyPersistentStoreOnDiskAndOpen: create tables and index failed.
437-->
438    <match>__CFURLCache:RecreateEmptyPersistentStoreOnDiskAndOpen: create tables and index failed.</match>
439    <description>com.apple.imfoundation.IMRemoteURLConnectionAgent: create tables and index failed</description>
440  </rule>
441</group>
442
443<!-- command rules -->
444
445<group name="local,command,">
446<rule id="140123" level="7">
447    <if_sid>530</if_sid>
448    <match>ossec: output: "netstat -tan |awk '/LISTEN/ && !/(127.0.0.1|::1)/'"</match>
449    <check_diff />
450    <description>Listened ports have changed (no localhost).</description>
451</rule>
452<rule id="140124" level="7">
453    <if_sid>530</if_sid>
454    <match>ossec: output: 'ipfw -t list'</match>
455    <check_diff />
456    <description>Firewall rules list</description>
457</rule>
458<!--
459<rule id="140125" level="7">
460    <if_sid>530</if_sid>
461    <match>ossec: output: 'dscl . list /users'</match>
462    <check_diff />
463    <description>List of users.</description>
464</rule>
465-->
466</group>
467
468<!-- Non-Apple Applications -->
469
470<group name="syslog,chrome,">
471  <rule id="120000" level="0">
472    <match>Process unable to create connection because the sandbox denied the right to lookup</match>
473    <description>Google Chrome log noise</description>
474  </rule>
475  <rule id="120001" level="0">
476    <match>CGSLookupServerRootPort: Failed to look up the port for "com.apple.windowserver.active"</match>
477    <description>Google Chrome log noise</description>
478  </rule>
479  <rule id="120002" level="0">
480<!--
481    <match>CoreText CopyFontsForRequest received mig IPC error (FFFFFECC) from font server</match>
482-->
483    <match>CoreText CopyFontsForRequest received mig IPC error </match>
484    <description>Google Chrome log noise</description>
485  </rule>
486  <rule id="120003" level="0">
487    <match>HIToolbox: received notification of WindowServer event port death.</match>
488    <description>Google Chrome log noise (system waking up?)</description>
489  </rule>
490  <rule id="120004" level="0">
491    <match>port matched the WindowServer port created in BindCGSToRunLoop</match>
492    <description>Google Chrome log noise (system waking up?)</description>
493  </rule>
494  <rule id="120005" level="0">
495<!--
496Mar  6 18:44:23 HOST Google Chrome Helper[50187]: CarbonCore: getattrlist(/private/var/folders/tt/tky8gycd2fn8s276sjk9gmb00000gp/T/.truecrypt_aux_mnt1, ATTR_VOL_CAPABILITIES, ...) failed (-1) with errno 1
497-->
498    <match>CarbonCore: getattrlist(/private/var/folders</match>
499    <description>Google Chrome log noise (CarbonCore: getattrlist)</description>
500  </rule>
501</group>
502
503<group name="syslog,GoogleSoftwareUpdateDaemon,">
504  <rule id="100911" level="0">
505    <match>-[KSMultiUpdateAction(KSActionProcessorDelegate) processingDone:] KSSilentUpdateAction updates complete (errors: 0).</match>
506    <description>GoogleSoftwareUpdateDaemon: ?</description>
507  </rule>
508</group>
509
510<group name="syslog,Dropbox,">
511  <rule id="100901" level="0">
512    <match>CGSAddSurface failed - error 268435459 (windowID:63)</match>
513    <description>Dropbox log noise</description>
514  </rule>
515</group>
516
517<group name="syslog,soffice,">
518  <rule id="100921" level="0">
519    <match>Failed to create connection to the daemon: connection timeout: did not receive reply</match>
520    <description>soffice log noise</description>
521  </rule>
522</group>
523
524<!-- EOF -->