[ossec-list] Re: OSSEC rule match time and timeframe

2017-07-11 Thread Fredrik Hilmersson
I did end up doing this, user and hostname. However this isn't the 'optimal' solution as I do prefer to get alerts from the user + hostname at other times then ignoring it every half an hour. I will look more into the element time later on, and see if there's a way to achieve what I were

[ossec-list] Re: OSSEC rule match time and timeframe

2017-07-04 Thread Jesus Linares
Hi Fredrik, do you want to ignore the rule 5501 if it is fired by your script?. is it not enough with the hostname and the user?. Regards. On Monday, July 3, 2017 at 12:10:18 PM UTC+2, Fredrik Hilmersson wrote: > > Hello, > > Lets say I have a script which runs once every half an hour. With a