The '<!--' above and '-->' below indicate that this is commented out.
Thanks. I am an idiot! > > The term "graph" did not appear in the log message at all. > I don't have access to ossec at the moment, but servername is probably > the hostname of the system the log message came from. If so, it won't > be available to the <match> option. Correct, graph was added for some other similar alert, I pasted it earlier to show what I added myself. Sorry for confusion. > I really recommend running the log message through ossec-logtest. > It'll give you a good amount of the information you need. Thanks for this tip. I will keep it in mind now onwards.
