[ossec-list] Email notification based on levels

[Tim Boyer]

OK, I'm obviously missing something perfectly simple here.  I just can't see
what it is.

I'm trying to notify on levels 4 and above only.  So the server says

<ossec_config>
  <global>
    <smtp_server>roosevelt.denmantire.com.</smtp_server>
    <email_from>[EMAIL PROTECTED]</email_from>
  </global>

  <email_alerts>
   <email_to>[EMAIL PROTECTED]</email_to>  
   <level>4</level>
  </email_alerts>

  <alerts>
    <log_alert_level>1</log_alert_level>
  </alerts>

But I'm still getting these emails every few minutes:

OSSEC HIDS Notification.
2008 Apr 03 14:30:11

Received From: (kyushu) 192.168.42.1->/var/log/messages
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Apr  3 14:30:09 kyushu.denmantire.com smbd[4878]:   read_data: read failure
for 4 bytes to client 192.168.0.26. Error = Connection reset by peer

Would someone kindly tell me what purely obvious thing I'm overlooking?

Thanks much...

-- tim --