http://www.ossec.net/doc/syntax/head_internal_options.analysisd.html#intopt-maild.groupping
Maybe? On Thu, May 17, 2012 at 9:59 AM, Phil Daws <[email protected]> wrote: > Hello, > > when there is a flood of alerts I believe OSSEC throttles them to a 15 > minute window and then sends out emails. Is there a way to disable this > feature as I have noticed that sometimes alerts are going to people that > should not be receiving them! > -- > Thanks, Phil >
