# NSLCD
:msg, contains, "<passwd=" stop
:msg, contains, "request denied by validnames option" stop
:msg, contains, "monitoring file `/etc/group`" stop
:msg, contains, "monitoring file `/etc/passwd`" stop
:msg, contains, "monitoring directory `/etc`" stop
:msg, contains, "1.3.6.1.4.1.4203.666.5.16" stop

# SLAPD
:msg, contains, "bdb_equality_candidates" stop
:msg, contains, "mdb_equality_candidates" stop
:msg, contains, "unrecognized control" stop

# AUDITD
:msg, contains, "audit: type=" stop
:msg, contains, "audit_printk_skb:" stop
:msg, contains, "audit_log_lost:" stop
:msg, contains, "audit_panic:" stop
:msg, contains, "audit: printk limit exceeded" stop
:msg, contains, "audit_lost=" stop
:msg, contains, "Audit daemon rotating" stop