OSSEC has a feature that once it has sent suppose 10 mails, then immediately, it will send a consolidated mail w.r.t these 10 events also....this value (i.e. 10) can be changed.
Regards Tanishk On Mon, Feb 7, 2011 at 10:23 PM, dan (ddp) <[email protected]> wrote: > If these are the email ossec sends out, it's because ossec gathers a > few alerts and sends them out together. The subject doesn't always > apply to all alerts. You can change the setting in > internal_options.conf so that ossec doesn't group alerts. > > On Mon, Feb 7, 2011 at 11:35 AM, <[email protected]> wrote: > > Can anyone tell me why my alerts are getting joined together like the > > example below. These all came from one alert level 10 Email. Thank You > > Christian... > > > > > > > > OSSEC HIDS Notification. > > 2011 Feb 01 06:36:09 > > > > Received From: (LNDBP05A) 172.x.x.x->/var/log/messages > > Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system." > > Portion of the log(s): > > > > Feb 1 06:36:08 lndbp05a kernel: Buffer I/O error on device sdm, logical > > block 0 > > > > > > > > --END OF NOTIFICATION > > > > > > > > OSSEC HIDS Notification. > > 2011 Feb 01 06:36:09 > > > > Received From: (LNDBP05A) 172.x.x.41->/var/log/messages > > Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system." > > Portion of the log(s): > > > > Feb 1 06:36:08 lndbp05a kernel: Buffer I/O error on device sdl, logical > > block 0 > > > > > > > > --END OF NOTIFICATION > > > > --END OF NOTIFICATION > > > > > > > > OSSEC HIDS Notification. > > 2011 Jan 28 09:30:08 > > > > Received From: (LNDBP05A) 172.x.x.41->/var/log/messages > > Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system." > > Portion of the log(s): > > > > Jan 28 09:30:06 lndbp05a kernel: Buffer I/O error on device sdy, logical > > block 0 > > > > > > > > --END OF NOTIFICATION > > > > > > > > OSSEC HIDS Notification. > > 2011 Jan 28 09:30:08 > > > > Received From: (LNDBP05A) 172.x.x.41->/var/log/messages > > Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system." > > Portion of the log(s): > > > > Jan 28 09:30:06 lndbp05a CA eHealth SystemEDGE[22303]: sysedge: failed to > > open /proc/net/snmp6, 2 > > > > > > > > --END OF NOTIFICATION > > > > > > > > OSSEC HIDS Notification. > > 2011 Jan 28 09:31:11 > > > > Received From: HIDS-PROD2->/var/log/messages > > Rule: 2933 fired (level 7) -> "Yum package updated." > > Portion of the log(s): > > > > Jan 28 09:31:10 HIDS-PROD2 yum: Updated: > openldap-2.3.43-12.el5_6.5.x86_64 > > > > > > > > --END OF NOTIFICATION > > > > > > > > OSSEC HIDS Notification. > > 2011 Jan 28 09:31:11 > > > > Received From: HIDS-PROD2->/var/log/messages > > Rule: 2933 fired (level 7) -> "Yum package updated." > > Portion of the log(s): > > > > Jan 28 09:31:11 HIDS-PROD2 yum: Updated: curl-7.15.5-9.el5_6.2.x86_64 > > > > > > > > --END OF NOTIFICATION > > > > > > > > OSSEC HIDS Notification. > > 2011 Jan 28 09:31:13 > > > > Received From: HIDS-PROD2->/var/log/messages > > Rule: 2933 fired (level 7) -> "Yum package updated." > > Portion of the log(s): > > > > Jan 28 09:31:11 HIDS-PROD2 yum: Updated: gdbm-1.8.0-26.2.1.el5_6.1.x86_64 > > > > > > > > --END OF NOTIFICATION > > OSSEC HIDS Notification. > > 2011 Jan 28 09:31:46 > > > > Received From: (MN19926S) 172.26.77.38->WinEvtLog > > Rule: 18103 fired (level 5) -> "Windows error event." > > Portion of the log(s): > > > > WinEvtLog: Application: ERROR(8): crypt32: (no user): no domain: > MN19926S: > > Failed auto update retrieval of third-party root list sequence number > from: > > < > http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt > > > > with error: The server name or address could not be resolved > > > > > > > > --END OF NOTIFICATION > > > > > > > > OSSEC HIDS Notification. > > 2011 Jan 28 09:31:46 > > > > Received From: (MN19926S) 172.26.77.38->WinEvtLog > > Rule: 18103 fired (level 5) -> "Windows error event." > > Portion of the log(s): > > > > WinEvtLog: Application: ERROR(8): crypt32: (no user): no domain: > MN19926S: > > Failed auto update retrieval of third-party root list sequence number > from: > > < > http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt > > > > with error: This network connection does not exist. > > > > > > > > --END OF NOTIFICATION > > > > > -- warm regards Tanishk Lakhaani
