How long did you wait? Does the realtime option work on your system? (I'm not sure the realtime option will alert on new files at all though...) Have you tried running a syscheck scan after creating the new file? Does it alert then?
On Mon, Aug 9, 2010 at 4:23 AM, [email protected] <[email protected]> wrote: > I put the below in ossec rules and restarted,Still email alert is not > coming. > > :( >
