On Tue, Feb 8, 2011 at 3:05 PM, Jeremy Lee <[email protected]> wrote: > What is the directive again for disabling grouping? > >
Look in /var/ossec/etc/internal_options.conf . # Maild grouping (0=disabled, 1=enabled) # Groups alerts within the same e-mail. maild.groupping=1 I'm sure there's a better "solution" (like finding out why the no grouping thing doesn't appear to work for you), but I'm not in a position to look at the moment. > On Tue, Feb 8, 2011 at 11:52 AM, dan (ddp) <[email protected]> wrote: >> >> On Tue, Feb 8, 2011 at 2:50 PM, jplee3 <[email protected]> wrote: >> > Hi all, >> > >> > I have the following directive in my ossec.conf: >> > >> > <email_alerts> >> > <email_to>[email protected]</email_to> >> > <rule_id>300042</rule_id> >> > <do_not_delay /> >> > <do_not_group /> >> > </email_alerts> >> > >> > >> > >> > This, I would assume, should only send the email of the 300042 >> > triggered event. Correct? >> > >> > If so, it appears to not be working properly because I am receiving >> > emails where multiple other events are grouped into the email. >> > >> > Is there anything else I can try? >> > >> > TIA >> >> You can turn off grouping entirely. > >
