On Sun, Jul 18, 2010 at 9:56 AM, Jason 'XenoPhage' Frisvold <[email protected]> wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > On Jul 16, 2010, at 2:18 AM, Nerijus Krukauskas wrote: >> <do_not_group> in ossec.conf is your friend. And there're options for >> maximum emails per hour/day. I just don't remember where they're >> specified. I guess searching through http://ossec.net/ or mailing list >> archives will bring up something. > > Aha .. grouping.. I'll look in that direction. Thanks! >
Take a look at "maild.groupping" in ossec/etc/internal_options.conf.
