One of your signatures has a bad ID. This is a pain, and you'll have to go through all of your local_rules.xml looking for it. Running the logtest in debug mode _might_ give you a hint as to where that rule is.
On Wed, Aug 11, 2010 at 6:06 AM, Assaf Flatto <[email protected]> wrote: > Hello > > I've tired to add a new rule to my OSSEC and when i issued the restart i > got this error in the log . > > I commented out the new rule , but the error persisted . > > Googleing this came up empty , not did the OSSEC wiki provide any help . > > Has anyone encountered this issue before ? and how can i have my OSSEC > back ?? > > # ../bin/ossec-logtest -f > 2010/08/11 11:01:50 rules_list: Signature ID must be an integer. Exiting... > gbc1-ossec-01:/var/ossec/rules # 2010/08/11 11:01:50 rules_list: > Signature ID must be an integer. Exiting... > > > Thanks > > -- > > Assaf Flatto > Linux System Administrator > No.9 | 6 Portal Way | London | W3 6RU | > T: +44 (0)20 88 96 8014 | M: +44 (0)75 3568 1067 > > > Next year I will be doing the London to Paris bike ride to > raise money for the DogTrust (www.dogtrust.co.uk) . > Please Sponsor me at http://www.justgiving.com/Assaf-Flatto > > > ________________________________ > > LOVEFiLM UK Limited is a company registered in England and Wales. > Registered Number: 06528297. > Registered Office: No.9, 6 Portal Way, London W3 6RU, United Kingdom. > > This e-mail is confidential to the ordinary user of the e-mail address to > which it was > addressed. If you have received it in error, please delete it from your > system and notify > the sender immediately. > > This email message has been delivered safely and archived online by > Mimecast. > For more information please visit http://www.mimecast.co.uk > > ________________________________
