Hi George,
> I should be seeing IIS log entries going to alerts.log shouldn't I? > > Not sure if you meant it like this, but you will not see log entries going to alerts.log. You will only see alerts based on your IIS log in the alerts.log file. Meaning, if your IIS logs do not contain any events that are generating alerts, then you will not see anything in alerts.log. Also, you need to have the IIS rules set in your ossec.conf (should be enabled by default)
