Hi, The email notification is triggered when an alert reach or overpass the level defined in <email_alert_level> (by default is set to level 7), setting this option to level 3 will send you email notifications for successful logins attempts.
*<email_alert_level> option reference:* http://ossec-docs.readthedocs.io/en/latest/syntax/head_ossec_config.alerts.html#element-email_alert_level *Rules clasification:* http://ossec-docs.readthedocs.io/en/latest/manual/rules-decoders/rule-levels.html. I hope this could help you Best regards. On Wednesday, June 28, 2017 at 2:03:23 PM UTC-4, az...@51ecommerce.com wrote: > > hello, > I've setup the ossec server and agent in my serverS(server) and > serverA(agent), but when I login into serverA, I have not receive the email > alert, but if I change something in serverA, I can receive the email alert. > So, my question is: how to make a email alert when some one login into > system, like ssh, or ftp > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
