hi, answer inline...
On Apr 3, 8:56 pm, "Tim Boyer" <[EMAIL PROTECTED]> wrote: > [...] > But I'm still getting these emails every few minutes: > > OSSEC HIDS Notification. > 2008 Apr 03 14:30:11 > > Received From: (kyushu) 192.168.42.1->/var/log/messages > Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system." > Portion of the log(s): Afaik mail for this rule is always sent, regardless of the minimum level. I suppose it is in the 1002 rule definition... You could override it, but wouldn't do that because it notifies you about really important stuff too, like servers/applications crashing. Better way would be to write al local rule to ignore above error message, if it really bothers you regards, matthias
