> hi, > > answer inline... > > On Apr 3, 8:56 pm, "Tim Boyer" <[EMAIL PROTECTED]> wrote: > > [...] > > But I'm still getting these emails every few minutes: > > > > OSSEC HIDS Notification. > > 2008 Apr 03 14:30:11 > > > > Received From: (kyushu) 192.168.42.1->/var/log/messages > > Rule: 1002 fired (level 2) -> "Unknown problem somewhere in > the system." > > Portion of the log(s): > > Afaik mail for this rule is always sent, regardless of the minimum > level. I suppose it is in the 1002 rule definition... > You could override it, but wouldn't do that because it notifies you > about really important stuff too, like servers/applications crashing. > Better way would be to write al local rule to ignore above error > message, if it really bothers you > > regards, matthias
Ah, so that's why I get notified when someone gets an email with a subject of 'Bad crash on Highway 82'. Didn't know it worked that way - I'll write the local rule. Thanks much... -- tim --
