[ossec-list] First time user logged in

[Forrest Aldrich]

This has also been a randomly recurring bug... It is, of course, not the first time I logged in - it's more like the 1,000,000th ;-) I also took note that the active response seems to work better on Linux than it does on *BSD. Received From: mail->/var/log/auth.log Rule: 10100 fired (level 4) -> "First time user logged in." Portion of the log(s): sshd[31491]: Accepted keyboard-interactive/pam for forrie from 192.168.1.1 port 61712 ssh2 --END OF NOTIFICATION