[ossec-list] Re: ossec server reporting itself as 0.0.0.0 and more

[Vitor Correia]

I agree with Leonardo's point of view. Meir, again thank you for your testing and patch, i'm trying it now. ./vcorreia Leonardo Goldim wrote: my idea to use the real ip instead 0.0.0.0 is to organize the alerts at base ... for example, i have a server that monitor many agents ... using base for analise the alerts, i can' t order by host, the alerts are mixed ... if use the dstip like real ip, i can go to dest ip addrs -> select an ip and i got all the alerts from that host, it's possible make this comparison that you explain using the srcip like 0.0.0.0 or real ip ... i will not hesitate, it's a productive debate. Vitor Correia Systems Administrator -- Mobbit Systems [EMAIL PROTECTED] | Telemóvel: + 351 916 448 025 Avenida do Forte, 8 - 1º Andar - Frente 01 - 2795-503 Carnaxide Telefone: + 351 21 418 01 40 | Fax: + 351 21 418 01 41 [EMAIL PROTECTED] | www.mobbit.net ,-O O(_)) for a better world `-O

begin:vcard
fn:Vitor Correia
n:Correia;Vitor
org:Mobbit Systems
adr;quoted-printable:;;Av. do Forte, N=C2=BA 8 - Andar O1;;Linda-a-Velha;2795-503;Portugal
email;internet:[EMAIL PROTECTED]
title:Sysadmin
tel;work:+351 21 418 01 40
tel;fax:+351 21 418 01 41
tel;cell:+351 91 644 80 25
x-mozilla-html:TRUE
url:http://www.mobbit.net
version:2.1
end:vcard