On Wed, Sep 15, 2010 at 7:20 PM, Jeremy Lee <[email protected]> wrote: > An easy way to check is to grep for the rule number in the rules dir... so: > > grep "554" /var/ossec/rules/* > > That should tell you which file it's in (note: you might see other > files/entries if "554" is in the string, but it should at least narrow > things down for you). > > > --Jeremy >
This might work a bit better (clean out the stuff you don't want to see): grep 'id="554"' /var/ossec/rules/*
