whatever way I tried logtest it didn't seem to pick it up, but I put it live anyhow and it worked !!!
I would love to understand the logic but sometimes life is too short -- thanks for checking. Pete Jon Barber wrote: > Hi > > Peter Robinson wrote: > > > > My rule is copied below with rule 11203 and output from ossec-logtest -f > > > > Logtest shows that my rule is tried but no match occurs against it. > > > ... > > <rule id="100610" level="10" frequency="3" timeframe="120"> > > > Works OK for me. Have you passing it through logtest 'frequency' times > within 'timeframe' seconds? > > Cheers > > Jon > > > >
