I assume that the alterative (since "maild.groupping" [sic] seems to be a binary value) is to get a single email for each alert. Hm. It'd be nice if the grouping feature only grouped alerts from the same source.
Also, there are Dire Warnings at the top of that file: # DO NOT TOUCH THIS FILE. The default configuration # is at ossec.conf. More information at: # http://www.ossec.net/en/manual.html # # This file should be handled with care. It contain # run time modifications that can affect the use # of ossec. Only change it if you know what you # are doing. Again, look first at ossec.conf # for most of the things you want to change. -- Shane Castle Data Security Mgr, Boulder County IT CISSP GSEC GCIH -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of dan (ddp) Sent: Monday, February 07, 2011 09:53 To: [email protected] Subject: Re: [ossec-list] Alert level 10 is including Multiple alerts from multiple clients If these are the email ossec sends out, it's because ossec gathers a few alerts and sends them out together. The subject doesn't always apply to all alerts. You can change the setting in internal_options.conf so that ossec doesn't group alerts. On Mon, Feb 7, 2011 at 11:35 AM, <[email protected]> wrote: > Can anyone tell me why my alerts are getting joined together like the > example below. These all came from one alert level 10 Email. Thank You > Christian... > > > > OSSEC HIDS Notification. > 2011 Feb 01 06:36:09 > > Received From: (LNDBP05A) 172.x.x.x->/var/log/messages > Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system." > Portion of the log(s): > > Feb 1 06:36:08 lndbp05a kernel: Buffer I/O error on device sdm, logical > block 0 > > > > --END OF NOTIFICATION > > > > OSSEC HIDS Notification. > 2011 Feb 01 06:36:09 > > Received From: (LNDBP05A) 172.x.x.41->/var/log/messages > Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system." > Portion of the log(s): > > Feb 1 06:36:08 lndbp05a kernel: Buffer I/O error on device sdl, logical > block 0 > > > > --END OF NOTIFICATION > > --END OF NOTIFICATION > > > > OSSEC HIDS Notification. > 2011 Jan 28 09:30:08 > > Received From: (LNDBP05A) 172.x.x.41->/var/log/messages > Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system." > Portion of the log(s): > > Jan 28 09:30:06 lndbp05a kernel: Buffer I/O error on device sdy, logical > block 0 > > > > --END OF NOTIFICATION > > > > OSSEC HIDS Notification. > 2011 Jan 28 09:30:08 > > Received From: (LNDBP05A) 172.x.x.41->/var/log/messages > Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system." > Portion of the log(s): > > Jan 28 09:30:06 lndbp05a CA eHealth SystemEDGE[22303]: sysedge: failed to > open /proc/net/snmp6, 2 > > > > --END OF NOTIFICATION > > > > OSSEC HIDS Notification. > 2011 Jan 28 09:31:11 > > Received From: HIDS-PROD2->/var/log/messages > Rule: 2933 fired (level 7) -> "Yum package updated." > Portion of the log(s): > > Jan 28 09:31:10 HIDS-PROD2 yum: Updated: openldap-2.3.43-12.el5_6.5.x86_64 > > > > --END OF NOTIFICATION > > > > OSSEC HIDS Notification. > 2011 Jan 28 09:31:11 > > Received From: HIDS-PROD2->/var/log/messages > Rule: 2933 fired (level 7) -> "Yum package updated." > Portion of the log(s): > > Jan 28 09:31:11 HIDS-PROD2 yum: Updated: curl-7.15.5-9.el5_6.2.x86_64 > > > > --END OF NOTIFICATION > > > > OSSEC HIDS Notification. > 2011 Jan 28 09:31:13 > > Received From: HIDS-PROD2->/var/log/messages > Rule: 2933 fired (level 7) -> "Yum package updated." > Portion of the log(s): > > Jan 28 09:31:11 HIDS-PROD2 yum: Updated: gdbm-1.8.0-26.2.1.el5_6.1.x86_64 > > > > --END OF NOTIFICATION > OSSEC HIDS Notification. > 2011 Jan 28 09:31:46 > > Received From: (MN19926S) 172.26.77.38->WinEvtLog > Rule: 18103 fired (level 5) -> "Windows error event." > Portion of the log(s): > > WinEvtLog: Application: ERROR(8): crypt32: (no user): no domain: MN19926S: > Failed auto update retrieval of third-party root list sequence number from: > <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> > with error: The server name or address could not be resolved > > > > --END OF NOTIFICATION > > > > OSSEC HIDS Notification. > 2011 Jan 28 09:31:46 > > Received From: (MN19926S) 172.26.77.38->WinEvtLog > Rule: 18103 fired (level 5) -> "Windows error event." > Portion of the log(s): > > WinEvtLog: Application: ERROR(8): crypt32: (no user): no domain: MN19926S: > Failed auto update retrieval of third-party root list sequence number from: > <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> > with error: This network connection does not exist. > > > > --END OF NOTIFICATION > >
