Try putting a space between rule id's <rule_id>10201, 10202</rule_id>
Make sure the ossec server ossec.conf has no extra carriage returns in it too. On Jan 10, 8:02 am, "--[ UxBoD ]--" <[email protected]> wrote: > Hi, > > I have just sent up a specific email alert in ossec.conf but the recipient is > receiving every alert! What have I mis-configured ? > > <email_alerts> > <email_to>[email protected]</email_to> > <rule_id>10201,10202</rule_id> > <event_location>a.client.server.com</event_location> > <do_not_delay/> > <do_not_group/> > </email_alerts> > > -- > Thanks, Phil
