It depends on why the rule is alerting. Some rules are configured to
always email, regardless of their level, and some rules will email
because their level is at or above your configured "email_alert_level."
An example of the first would be rule 502, located in
$OSSEC_DIR/rules/ossec_rules.xml. The definition for this rule should
look like this:
<rule id="502" level="3">
<if_sid>500</if_sid>
<options>alert_by_email</options>
<match>Ossec started</match>
<description>Ossec server started.</description>
</rule>
If you want to disable a rule like this, just remove the options line
(or, if there are multiple options, just remove "alert_by_email").
For the other case, you have two choices. You can either raise
"email_alert_level" in $OSSEC_DIR/etc/ossec.conf, or you can create a
custom rule that will override the level. If you want to create a custom
rule, I wrote an article on how to tune unwanted rules. You can find it
at http://news.hurricanelabs.com/article.php?story=20071228095952670.
Hope this answers your question.
Dave Rutlidge wrote:
> Some rules always send emails, but I don;t want tem to. How can I turn
> off email notification for specific rules?
>
> TIA
>
> Dave
