Hey Jonny, As discussed in another thread, by default if there are multiple alerts in the queue they will be grouped. A couple ways around this include setting </do_not_group> in the granular email options or by setting it globally in internal_options.conf (local_internal_options.conf in 1.6).
granular email config: http://www.ossec.net/wiki/index.php/Know_How:GranularEmail internal_options.conf: maild.groupping=0 Cheers, cnk On Fri, Sep 19, 2008 at 11:54 AM, Jonny Gerold <[EMAIL PROTECTED]> wrote: > > Hello, > I was wondering how default grouping works. A link would be nice? I'm > just wondering because sometimes I will get an email with one alert, and > sometimes I will get one with 100 alerts. And the subject line doesn't > announce this. The subject line just says one alert. > > Thanks, Jonny >
