Re: [ossec-list] Rule ID 5701? Possible attack on the SSH server? All agents inactive, what gives?

[dan (ddp)]

On Thu, Jul 26, 2012 at 12:55 AM, William Lindfors
<lindfo...@checkers.com> wrote:
>
>
>
>
> Latest events
>
>
>
> 2012 Jul 26 00:47:01 Rule Id: 5701 level: 8
> Location: profim01->/var/log/secure
> Src IP: UNKNOWN
> Possible attack on the ssh server (or version gathering).

What's the question exactly?