Uhmmmm ... no ... no ... it was something completely different. If it's any comfort, your response precluded Moronic Question #s 2 & 3 ... :)
Thanks, Dan. On May 9, 2:32 pm, "dan (ddp)" <[email protected]> wrote: > I hope you don't mean rule 1002 or any of the other ~22 rules that > have the <alert_by_email> option set. It'd be disheartening to have to > explain this again this week. > > On Wed, May 9, 2012 at 2:19 PM, [email protected] > > > > <[email protected]> wrote: > > I must be missing something - I have my alerting threshold set to "8" > > in the ossec-server.conf file, but continue to receive email > > notifications (alerts?) for a number of events which have been defined > > as 7 and below. Ossec-hids suite was restarted after mods were made - > > where am I running off the track?- Hide quoted text - > > - Show quoted text -
