On Tue, Feb 8, 2011 at 2:50 PM, jplee3 <[email protected]> wrote: > Hi all, > > I have the following directive in my ossec.conf: > > <email_alerts> > <email_to>[email protected]</email_to> > <rule_id>300042</rule_id> > <do_not_delay /> > <do_not_group /> > </email_alerts> > > > > This, I would assume, should only send the email of the 300042 > triggered event. Correct? > > If so, it appears to not be working properly because I am receiving > emails where multiple other events are grouped into the email. > > Is there anything else I can try? > > TIA
You can turn off grouping entirely.
