On Fri, July 16, 2010 05:18, Jason 'XenoPhage' Frisvold wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Hi all, > > Should email alerts include alerts from multiple hosts? I'm getting > emails from OSSEC that indicate one host in the subject, but then contain > alerts from multiple hosts in the body of the message.
<do_not_group> in ossec.conf is your friend. And there're options for maximum emails per hour/day. I just don't remember where they're specified. I guess searching through http://ossec.net/ or mailing list archives will bring up something. -- http://nk99.org/
