Hi guys, I've been battling with this for a good few weeks now and am starting to wonder if it is even possible to do what I want. Here goes.
My goal: When any file(s) or folder(s) within the c:\testing_ossec/ directory of SERVER1 are added/removed/changed an email alert will be sent to [email protected]. No other alerts about this server should be sent to [email protected]. My config: Server: Ubuntu 8.04.2 running OSSEC HIDS 2.0 (server) email_alerts from /var/ossec/etc/ossec.conf: <ossec_config> <email_alerts> <email_to>[email protected]</email_to> <event_location>SERVER1</event_location> <rule_id>100105</rule_id> <level>14</level> <group>syscheck</group> <do_not_delay /> <do_not_group /> </email_alerts> </ossec_config> Rule 100105 from /var/ossec/rules/local_rules.xml: <rule id="100105" level="15"> <hostname>SERVER1</hostname> <match>testing_ossec</match> <description>Test rule for specific email alerts</description> </rule> Client (SERVER1): Windows Server 2003 Enterprise w/SP2 running OSSEC HIDS 2.0 (client) My addition to C:\Program Files\ossec-agent\ossec.conf: <directories check_all="yes">C:\testing_ossec</directories> My results: Once I specified the rule_id 100105 within the <ossec_config> -> <email_alerts> I get nothing. If I leave that tag out then it will at least send me notification about deleted files, but nothing for new or modified files. Before adding the <level> and <group> tags it would also send me all other unrelated notifications from the host. I added those two tags and have disabled email grouping to avoid sending the unrelated alerts to the user, but it still seems to be missing those alerts about new or modified files. I started out on OSSEC HIDS 1.5, then upgraded the server and clients all to v2.0, and I even rebuilt the Ubuntu server and reinstalled the clients but no luck. Could anybody please help me to see where I am failing with this? Thank you, Nick
