Re: [ossec-list] Help to eliminate false positive

[Scott Nelson]

On Dec 11, 2012, at 4:16 PM, dan (ddp) wrote:

> You could match on the fatal-errors@blahblah as above, but set the
> level higher. Then create a child rule matching the Ok: queued bit.

Sure.  Thank's a lot for your help, Dan.

Scott