Yep, it was indeed the missing space. Perhaps that could be a future fix ? -- Thanks, Phil
----- Original Message ----- > Try putting a space between rule id's > <rule_id>10201, 10202</rule_id> > > Make sure the ossec server ossec.conf has no extra carriage returns > in > it too. > > > On Jan 10, 8:02 am, "--[ UxBoD ]--" <[email protected]> wrote: > > Hi, > > > > I have just sent up a specific email alert in ossec.conf but the > > recipient is receiving every alert! What have I mis-configured ? > > > > <email_alerts> > > <email_to>[email protected]</email_to> > > <rule_id>10201,10202</rule_id> > > <event_location>a.client.server.com</event_location> > > <do_not_delay/> > > <do_not_group/> > > </email_alerts> > > > > -- > > Thanks, Phil >
