Andrew, I had the same problem so I reported it to Daniel. He wrote back saying:
I was testing it right now and there is indeed a bug. I added the <ignore> configuration, but somehow managed to forget to commit the code to actually check it... It is fixed on this snapshot: http://www.ossec.net/files/snapshots/ossec-hids-090929.tar.gz Thanks, -- Daniel B. Cid
