Any info logged to ossec/logs/active-responses.log? Aaron
On Mon, May 11, 2009 at 5:11 PM, John Lewis <[email protected]> wrote: > I have an agent installed on an internet facing system, and am trying to get > active response working for it. > > > > Here’s what I have in the agent’s ossec.conf file, AND the server’s > ossec.conf: > > <command> > > <name>host-deny</name> > > <executable>host-deny.sh</executable> > > <expect>srcip</expect> > > <timeout_allowed>yes</timeout_allowed> > > </command> > > > > <active-response> > > <command>host-deny</command> > > <location>local</location> > > <level>10</level> > > <rules_id>5551,5720</rules_id> > > <timeout>600</timeout> > > </active-response> > > > > Rules 5551 and 5720 are kicking off at level 10 for that agent, and nothing > is happening. > > > > What am I missing? I don’t see anything unusual in logs/ossec.log
