I recently added the <reports> configuration to my ossec.conf file but something isn't working correctly because the emails are showing up blank. I have read all the posts about the report showing up in the subject line but that isn't happen in this case. The subject line is correct but the email body is completely blank. I have tried different categories but nothing seems to work.
Here is my current reports entry in ossec.conf: <reports> <category>syscheck</category> <title>Daily Report: Changed Files</title> <email_to>[email protected]</email_to> </reports> Does it matter where this sits in the config file. I have moved it around in the config as well but no change. I can manually run the reports using the following command and receive output. zcat /var/ossec/logs/alerts/2010/Oct/ossec-alerts-28.log.gz | /var/ ossec/bin/ossec-reportd -n "Summary" -f group syscheck Is my SMTP server striping the contents of the body out or something? The OSSEC server is pointed to an Exchange SMTP server. The email alerts are working correctly but these reports don't want to cooperate. If anyone has any suggestions for me I would appreciate it. These reports would be much nicer than having to setup a cron job to run the reports manually. Thanks! D
