Re: [ossec-list] Custom Rule Debugging

[Nick Davies]

>
> Did you remove the header from the entry in archives.log?

Almost definately not.  Which part of the archive.log entry
constitutes the header?

Regards,

Nick