Interestingly there are entries in the active-response log for that ip. and a series of these ...
** Alert 1195896462.4274: - syslog,sshd,invalid_login, 2007 Nov 24 09:27:42 thecla2->/var/log/auth.log Rule: 5710 (level 5) -> 'Attempt to login using a non-existent user' Src IP: 65.254.35.58 User: (none) Nov 24 09:27:40 thecla2 sshd[921]: Invalid user mythtv from 65.254.35.58 These were in the alert log. Just no email. Ill look in the email logs to see if it went astray there but its odd I get other alerts and it didnt get flagged as spam. Thanks On Sun, 2007-11-25 at 11:25 -0400, Daniel Cid wrote: > Are you sure it is not being caught? I ran your log in here and got an > alert (using v1.4): > -- Regards Martin West 07809 305 404 skype:amartinwest1 http://www.objectgizmos.com 16 SHEARWAY BUSINESS PARK,FOLKESTONE,KENT,CT19 4RH Company No. 05912944
