Thank you Both for the quick responses. >>> tanishk lakhaani <[email protected]> 2/7/2011 12:31 PM >>> OSSEC has a feature that once it has sent suppose 10 mails, then immediately, it will send a consolidated mail w.r.t these 10 events also....this value (i.e. 10) can be changed. Regards Tanishk
On Mon, Feb 7, 2011 at 10:23 PM, dan (ddp) <[email protected]> wrote: If these are the email ossec sends out, it's because ossec gathers a few alerts and sends them out together. The subject doesn't always apply to all alerts. You can change the setting in internal_options.conf so that ossec doesn't group alerts. On Mon, Feb 7, 2011 at 11:35 AM, <[email protected]> wrote: > Can anyone tell me why my alerts are getting joined together like the > example below. These all came from one alert level 10 Email. Thank You > Christian... > > > > OSSEC HIDS Notification. > 2011 Feb 01 06:36:09 > > Received From: (LNDBP05A) 172.x.x.x->/var/log/messages > Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system." > Portion of the log(s): > > Feb 1 06:36:08 lndbp05a kernel: Buffer I/O error on device sdm, logical > block 0 > > > > --END OF NOTIFICATION > > > > OSSEC HIDS Notification. > 2011 Feb 01 06:36:09 > > Received From: (LNDBP05A) 172.x.x.41->/var/log/messages > Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system." > Portion of the log(s): > > Feb 1 06:36:08 lndbp05a kernel: Buffer I/O error on device sdl, logical > block 0 > > > > --END OF NOTIFICATION > > --END OF NOTIFICATION > > > > OSSEC HIDS Notification. > 2011 Jan 28 09:30:08 > > Received From: (LNDBP05A) 172.x.x.41->/var/log/messages > Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system." > Portion of the log(s): > > Jan 28 09:30:06 lndbp05a kernel: Buffer I/O error on device sdy, logical > block 0 > > > > --END OF NOTIFICATION > > > > OSSEC HIDS Notification. > 2011 Jan 28 09:30:08 > > Received From: (LNDBP05A) 172.x.x.41->/var/log/messages > Rule: 1002 fired (level 2) -> "Unknown problem somewhere in the system." > Portion of the log(s): > > Jan 28 09:30:06 lndbp05a CA eHealth SystemEDGE[22303]: sysedge: failed to > open /proc/net/snmp6, 2 > > > > --END OF NOTIFICATION > > > > OSSEC HIDS Notification. > 2011 Jan 28 09:31:11 > > Received From: HIDS-PROD2->/var/log/messages > Rule: 2933 fired (level 7) -> "Yum package updated." > Portion of the log(s): > > Jan 28 09:31:10 HIDS-PROD2 yum: Updated: openldap-2.3.43-12.el5_6.5.x86_64 > > > > --END OF NOTIFICATION > > > > OSSEC HIDS Notification. > 2011 Jan 28 09:31:11 > > Received From: HIDS-PROD2->/var/log/messages > Rule: 2933 fired (level 7) -> "Yum package updated." > Portion of the log(s): > > Jan 28 09:31:11 HIDS-PROD2 yum: Updated: curl-7.15.5-9.el5_6.2.x86_64 > > > > --END OF NOTIFICATION > > > > OSSEC HIDS Notification. > 2011 Jan 28 09:31:13 > > Received From: HIDS-PROD2->/var/log/messages > Rule: 2933 fired (level 7) -> "Yum package updated." > Portion of the log(s): > > Jan 28 09:31:11 HIDS-PROD2 yum: Updated: gdbm-1.8.0-26.2.1.el5_6.1.x86_64 > > > > --END OF NOTIFICATION > OSSEC HIDS Notification. > 2011 Jan 28 09:31:46 > > Received From: (MN19926S) 172.26.77.38->WinEvtLog > Rule: 18103 fired (level 5) -> "Windows error event." > Portion of the log(s): > > WinEvtLog: Application: ERROR(8): crypt32: (no user): no domain: MN19926S: > Failed auto update retrieval of third-party root list sequence number from: > <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> > with error: The server name or address could not be resolved > > > > --END OF NOTIFICATION > > > > OSSEC HIDS Notification. > 2011 Jan 28 09:31:46 > > Received From: (MN19926S) 172.26.77.38->WinEvtLog > Rule: 18103 fired (level 5) -> "Windows error event." > Portion of the log(s): > > WinEvtLog: Application: ERROR(8): crypt32: (no user): no domain: MN19926S: > Failed auto update retrieval of third-party root list sequence number from: > <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> > with error: This network connection does not exist. > > > > --END OF NOTIFICATION > > -- warm regards Tanishk Lakhaani
