diff --git a/docs/development/updating_ossec.rst b/docs/development/updating_ossec.rst index 475fe9d26..cae3878ca 100644 --- a/docs/development/updating_ossec.rst +++ b/docs/development/updating_ossec.rst @@ -129,6 +129,15 @@ You can find this ``program_name`` value using the :ref:`"ossec-logtest" command `. Copy-paste the log event as input to this command, and it will give you some parsed output: +.. + Warning to editors: The instances of "“" in this example come verbatim + from actual OSSEC alerts reported (and reproduced) in + freedomofpress/securedrop#5835. Whether or not they should be considered + invalid *output* from OSSEC, they are valid *input* for the purpose of this + example and documentation. See + + for a prior discussion on this point. + :: $ echo "Mar 1 13:22:53 app fwupd[133921]: 13:22:53:0883 FuPluginUefi Error opening directory “/sys/firmware/efi/esrt/entries�: No such file or directory" | sudo /var/ossec/bin/ossec-logtest