I recently added an additional <active_response> tag to my ossec.conf file. In order to test it, I wanted to disable the first active response, so I added the <disabled>yes</disabled> tag to it. ossec-execd saw the first active response was disabled and terminated itself thinking that ALL active reponses were disabled (according to what was in ossec.log).
Is this a bug?
