[ossec-list] Re: Help shutting down an alert

[Forrest Aldrich]

That breaks everything.   You need to put local_rules.xml LAST in the <rules> section of ossec.conf. This I just found out the hard way. _F Meir Michanie wrote: always put your local_rules.xml second just after rules_config.xml