That brings me to another question, however. We have <hostname> as a possible rule condition, but not <agentname>.
Shouldn't this be added? To unsubscribe from this group, send email to ossec-list+unsubscribegooglegroups.com or reply to this email with the words "REMOVE ME" as the subject.
