{
  "title": "accelppp_dhcpv4_short_packet",
  "description": "accel-ppp: malformed/truncated DHCPv4 packet received - found live in a real 1GB accel-ppp log sample (2026-07-23), format: 'warn: dhcpv4: short packet received' (no interface in the text itself, unlike most other accel-ppp warnings)",
  "source": "rule \"accelppp_dhcpv4_short_packet\"\nwhen\n  contains(to_string($message.message), \"dhcpv4: short packet received\")\nthen\n  set_field(\"vendor\", \"accel-ppp\");\n  set_field(\"event_type\", \"dhcpv4_short_packet\");\n  set_field(\"severity_tag\", \"warning\");\nend"
}