Hi, you have to restart the server before the rule is recognized by the analysis engine.
On Wed, Mar 3, 2010 at 8:35 AM, --[ UxBoD ]-- <[email protected]> wrote: > Hi, > > If I add a local rule is the change instantaneous or does it require a > restart of the ossec ? > > -- > Thanks, Phil >
