Several rules have an option set to send an email alert regardless of email alert settings in the config file for ossec....
Look in syslog_rules.xml and find rule 1002, it will have this: <options>alert_by_email</options> You can remove it if you like, but I'd suggest creating a rule to match the 'unknown error' that rule 1002 keeps picking up, then maybe rule 1002 won't trip...not sure how it works exactly so I can't give you specifics, I'm sure others will be able to provide more help. -cb On Thu, Apr 3, 2008 at 1:56 PM, Tim Boyer <[EMAIL PROTECTED]> wrote: > > OK, I'm obviously missing something perfectly simple here. I just can't > see > what it is. > > I'm trying to notify on levels 4 and above only. So the server says > > <ossec_config> > <global> > <smtp_server>roosevelt.denmantire.com.</smtp_server> > <email_from>[EMAIL PROTECTED]</email_from> > </global> > > <email_alerts> > <email_to>[EMAIL PROTECTED]</email_to> > <level>4</level> > </email_alerts> > > <alerts> > <log_alert_level>1</log_alert_level> > </alerts> > > But I'm still getting these emails every few minutes: > > OSSEC HIDS Notification. > 2008 Apr 03 14:30:11 > > Received From: (kyushu) 192.168.42.1->/var/log/messages > Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system." > Portion of the log(s): > > Apr 3 14:30:09 kyushu.denmantire.com smbd[4878]: read_data: read > failure > for 4 bytes to client 192.168.0.26. Error = Connection reset by peer > > Would someone kindly tell me what purely obvious thing I'm overlooking? > > Thanks much... > > -- tim -- > >
