What is the directive again for disabling grouping?
On Tue, Feb 8, 2011 at 11:52 AM, dan (ddp) <[email protected]> wrote: > On Tue, Feb 8, 2011 at 2:50 PM, jplee3 <[email protected]> wrote: > > Hi all, > > > > I have the following directive in my ossec.conf: > > > > <email_alerts> > > <email_to>[email protected]</email_to> > > <rule_id>300042</rule_id> > > <do_not_delay /> > > <do_not_group /> > > </email_alerts> > > > > > > > > This, I would assume, should only send the email of the 300042 > > triggered event. Correct? > > > > If so, it appears to not be working properly because I am receiving > > emails where multiple other events are grouped into the email. > > > > Is there anything else I can try? > > > > TIA > > You can turn off grouping entirely. >
