Hi Gary, It runs the active responses as "root". However, if you just want to store the alerts in MySQL, why don't you use the database support already implemented?
Info on the db support: http://www.ossec.net/wiki/index.php/Know_How:DatabaseOutput For some examples on custom active responses: http://www.ossec.net/wiki/index.php/Know_How:CustomActiveResponses Hope it helps. -- Daniel B. Cid dcid ( at ) ossec.net On Wed, Apr 16, 2008 at 6:10 PM, Bristol, Gary L. <[EMAIL PROTECTED]> wrote: > > > > > The OSSEC server is running Redhat EL v5. > > > > I was wondering that when it executes an active response rule what user is > it running as? > > > > I'm trying to build a script that will log into a MySql database and record > the Src IP and would like to setup a pre-shared key for the user between > the two systems. > > > > thanks
