Delahunty, Mark wrote: > Is this normal? If so can I make OSSEC send emails containing alerts for > only one server?
As others have noted, this is normal behavior. There is, however, an option to change it. You can use the <do_not_group /> tag in ossec.conf to change this behavior. For example, see here: http://www.mail-archive.com/[email protected]/msg02872.html
