Can anyone tell me why my alerts are getting joined together like the example
below. These all came from one alert level 10 Email. Thank You Christian...
OSSEC HIDS Notification.
2011 Feb 01 06:36:09
Received From: (LNDBP05A) 172.x.x.x->/var/log/messages
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):
Feb 1 06:36:08 lndbp05a kernel: Buffer I/O error on device sdm, logical block 0
--END OF NOTIFICATION
OSSEC HIDS Notification.
2011 Feb 01 06:36:09
Received From: (LNDBP05A) 172.x.x.41->/var/log/messages
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):
Feb 1 06:36:08 lndbp05a kernel: Buffer I/O error on device sdl, logical block 0
--END OF NOTIFICATION
--END OF NOTIFICATION
OSSEC HIDS Notification.
2011 Jan 28 09:30:08
Received From: (LNDBP05A) 172.x.x.41->/var/log/messages
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):
Jan 28 09:30:06 lndbp05a kernel: Buffer I/O error on device sdy, logical block 0
--END OF NOTIFICATION
OSSEC HIDS Notification.
2011 Jan 28 09:30:08
Received From: (LNDBP05A) 172.x.x.41->/var/log/messages
Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system."
Portion of the log(s):
Jan 28 09:30:06 lndbp05a CA eHealth SystemEDGE[22303]: sysedge: failed to open
/proc/net/snmp6, 2
--END OF NOTIFICATION
OSSEC HIDS Notification.
2011 Jan 28 09:31:11
Received From: HIDS-PROD2->/var/log/messages
Rule: 2933 fired (level 7) -> "Yum package updated."
Portion of the log(s):
Jan 28 09:31:10 HIDS-PROD2 yum: Updated: openldap-2.3.43-12.el5_6.5.x86_64
--END OF NOTIFICATION
OSSEC HIDS Notification.
2011 Jan 28 09:31:11
Received From: HIDS-PROD2->/var/log/messages
Rule: 2933 fired (level 7) -> "Yum package updated."
Portion of the log(s):
Jan 28 09:31:11 HIDS-PROD2 yum: Updated: curl-7.15.5-9.el5_6.2.x86_64
--END OF NOTIFICATION
OSSEC HIDS Notification.
2011 Jan 28 09:31:13
Received From: HIDS-PROD2->/var/log/messages
Rule: 2933 fired (level 7) -> "Yum package updated."
Portion of the log(s):
Jan 28 09:31:11 HIDS-PROD2 yum: Updated: gdbm-1.8.0-26.2.1.el5_6.1.x86_64
--END OF NOTIFICATION
OSSEC HIDS Notification.
2011 Jan 28 09:31:46
Received From: (MN19926S) 172.26.77.38->WinEvtLog
Rule: 18103 fired (level 5) -> "Windows error event."
Portion of the log(s):
WinEvtLog: Application: ERROR(8): crypt32: (no user): no domain: MN19926S:
Failed auto update retrieval of third-party root list sequence number from:
<http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The server name or address could not be resolved
--END OF NOTIFICATION
OSSEC HIDS Notification.
2011 Jan 28 09:31:46
Received From: (MN19926S) 172.26.77.38->WinEvtLog
Rule: 18103 fired (level 5) -> "Windows error event."
Portion of the log(s):
WinEvtLog: Application: ERROR(8): crypt32: (no user): no domain: MN19926S:
Failed auto update retrieval of third-party root list sequence number from:
<http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.
--END OF NOTIFICATION
