Hi Ceg, Yes, you can certainly do that by using the <hostname> tag. For example:
<hostname>vsftpd.log</hostname> *the hostname option includes the agent name + agent ip + log file. Thanks, -- Daniel B. Cid dcid ( at ) ossec.net On Mon, Dec 29, 2008 at 2:20 AM, Ceg Ryan <[email protected]> wrote: > Dear All, > > How can I ignore a rule for log file : /var/log/vsftpd.log only ? > > I have read http://www.ossec.net/wiki/index.php/Know_How:Ignore_Rules > but it do not help. > > Thanks. > > Ceg Ryan >
