Hi, This is not an error on OSSEC, but a log from the Windows event log. Do you want to ignore it inside OSSEC or learn how to fix it on Windows? Ignoring on ossec is easy, but you may want to fix the real problem.
http://www.ossec.net/wiki/index.php/Know_How:Ignore_Rules A sample local rule for you: <rule id="100101" level="0"> <if_sid>18103</if_sid> <match>ERROR(29): W32Time:</match> <description>Event ignored</description> </rule> Hope it helps. -- Daniel B. Cid dcid ( at ) ossec.net On Dec 13, 2007 9:57 AM, Shige <[EMAIL PROTECTED]> wrote: > Hello, > > I need help. Please how can i fix this error message: > > > > > ** Alert 1196751959.5395: - windows,system_error, > > > 2007 Dec 04 04:05:59 > > > (winxp01) 192.168.2.3->WinEvtLog > > > Rule: 18103 (level 5) -> > > > 'Windows error event.' > > > Src IP: (none) > > > User: (no user) > > > WinEvtLog: System: ERROR(29): W32Time: (no user): > > > no domain: CYFER: >
