title: OSSEC | How to add an exception rule
body: <p>I have the standard syslog_rules.xml (OSSEC 2.6.0).
  This is the standard rule for bad words in the <code>/var/log/messages</code> file:</p>
  
  <pre><code>&lt;var name="BAD_WORDS"&gt;core_dumped|failure|error|attack|bad |illegal |denied|refused|unauthorized|fatal|failed|Segmentation Fault|Corrupted&lt;/var&gt;
  .....    
  &lt;rule id="1002" level="2"&gt;
  &lt;match&gt;$BAD_WORDS&lt;/match&gt;
  &lt;options&gt;alert_by_email&lt;/options&gt;
  &lt;description&gt;Unknown problem somewhere in the system.&lt;/description&gt;
  &lt;/rule&gt;
  .....
  </code></pre>
  
  <p>How can I add or modify this rule that uses <code>$BAD_WORDS</code>, but excludes the <code>auxpropfunc error</code> phrase? That is, something like this:</p>
  
  <pre><code>&lt;match&gt;$BAD_WORDS&lt;/match&gt;
  &lt;match&gt;!auxpropfunc error&lt;/match&gt;
  &lt;options&gt;alert_by_email&lt;/options&gt;
  </code></pre>
  
  <p>Any ideas?</p>