Hi Mark, As Michael said, you can disable that in the granular configuration per each section or globally by changing the file internal_options.conf (or creating a new one, local_internal_options.conf) and setting the value of maild.groupping to 0:
# Maild grouping (0=disabled, 1=enabled) # Groups alerts within the same e-mail. maild.groupping=1 Thanks, -- Daniel B. Cid dcid ( at ) ossec.net On Sun, Mar 29, 2009 at 11:34 AM, Michael Starks <[email protected]> wrote: > > Delahunty, Mark wrote: >> Is this normal? If so can I make OSSEC send emails containing alerts for >> only one server? > > As others have noted, this is normal behavior. There is, however, an > option to change it. You can use the <do_not_group /> tag in ossec.conf > to change this behavior. For example, see here: > http://www.mail-archive.com/[email protected]/msg02872.html >
