Hi Peter Robinson wrote: > > My rule is copied below with rule 11203 and output from ossec-logtest -f > > Logtest shows that my rule is tried but no match occurs against it. > ... > <rule id="100610" level="10" frequency="3" timeframe="120">
Works OK for me. Have you passing it through logtest 'frequency' times within 'timeframe' seconds? Cheers Jon
