Follow on question; What are the user type="relation" options? Because we use DHCP, we have non-unique scrip, and I'd like to generate an auth report daily by system. I've tried system_name and hostname, neither of which work.
On Jun 5, 2012, at 8:10 AM, Eero Volotinen wrote: > Hi List, > > What is correct syntax of multiple email reports on ossec.conf: > > is it like this ? > > <reports> > <category>authentication_success</category> > <user type="relation">srcip</user> > <title>Daily report: Successful logins</title> > <email_to>[email protected]</email_to> > </reports> > > <reports> > <category>syscheck</category> > <title>Daily report: File changes</title> > <email_to>[email protected]</email_to> > </reports> > > I just want both reports to my email at daily > > thanks. > > br, > -- > Eero Scott
