Hi Dan, ok, I did it and now I am waiting. How do I select specific nodes?
Mike 2010/10/26 dan (ddp) <[email protected]> > There is no srcip decoded in the log message (and no IP at all). > Remove that line and it should work. > > On Tue, Oct 26, 2010 at 9:25 AM, Mike Sievers > <[email protected]> wrote: > > Hi List, > > > > for example: (server1=agent) > > > > OSSEC HIDS Notification. > > 2010 Oct 26 15:06:00 > > > > Received From: (server1) 192.168.224.49->/var/log/messages > > Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system." > > Portion of the log(s): > > > > Oct 26 15:06:26 server1 libvirtd: 15:06:26.774: error : > virLibConnError:441 > > : this function is not supported by the hypervisor: > > virConnectNumOfInterfaces > > > > --END OF NOTIFICATION > > > > local config at the manager: > > > > <rule id="100106" level="0"> > > <if_sid>1002</if_sid> > > <match>virLibConnError:441</match> > > <srcip>192.168.224.49</srcip> > > <description>Ignoring</description> > > </rule> > > > > What is wrong? > > > > Mike > > >
