Hello, Is it possible to add third command to active response script, "stop" for example? I have next situation:
1. active-response has added a lots of IP's to pf's table. 2. On shutdown ossec run one active-response "delete" script for every IP at *one time*. After that LA is > 200 and a server don't response on any request. So, it would be good if ossec run active-response script with arg "stop" on shutdown event. -- DSS5-RIPE DSS-RIPN mailto:[EMAIL PROTECTED] xmpp:[EMAIL PROTECTED] http://wizard.volgograd.ru/ 2:550/[EMAIL PROTECTED] 2:550/[EMAIL PROTECTED]
