Re: [ossec-list] Re: Global Mail limit

Well, why there is such low limit without #define INT_MAX_VALUE YY Is should be like (Mail->maxperhour > INT_MAX_VALUE) ? -- Eero 2016-01-28 16:22 GMT+02:00 : > Hi, > > I found that limit and it's hardcoded at function Read_Global(), in > src/config/global-config.c > > if

Re: [ossec-list] Re: Global Mail limit

I added this limit early on to prevent a flood of emails in case of a config mistake or an attack. Plus, operationally speaking, I doubt any team can realistically handle and investigate more than 10,000+ emails in an hour :) thanks, On Fri, Jan 29, 2016 at 1:16 PM, Eero Volotinen

Re: [ossec-list] Re: Global Mail limit

Well, how about still using some #define MAX_VALUE for that ? 2016-01-29 20:47 GMT+02:00 Daniel Cid : > I added this limit early on to prevent a flood of emails in case of a > config mistake or an attack. > > Plus, operationally speaking, I doubt any team can realistically

[ossec-list] Re: Global Mail limit

Hi, I found that limit and it's hardcoded at function Read_Global(), in src/config/global-config.c if ((Mail->maxperhour <= 0) || (Mail->maxperhour > )) { merror(XML_VALUEERR, __local_name, node[i]->element, node[i]->content); return (OS_INVALID); } You may increase this limit as you need