[ossec-list] I can not suppress some messages

[Mike Sievers]

Hi List,

for example: (server1=agent)

OSSEC HIDS Notification.
2010 Oct 26 15:06:00

Received From: (server1) 192.168.224.49->/var/log/messages
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):

Oct 26 15:06:26 server1 libvirtd: 15:06:26.774: error : virLibConnError:441
: this function is not supported by the hypervisor:
virConnectNumOfInterfaces

 --END OF NOTIFICATION

local config at the manager:

<rule id="100106" level="0">
    <if_sid>1002</if_sid>
    <match>virLibConnError:441</match>
    <srcip>192.168.224.49</srcip>
    <description>Ignoring</description>
  </rule>

What is wrong?

Mike