are you checking the right logs and do you have the ARs set for the right place? Sometimes people forget the log entries will be in agents log files, not the SERVER.
On Wednesday, March 13, 2013 10:56:34 AM UTC-7, BP9906 wrote: > > Hello, > I recently upgraded my ossec server to 2.7 and everything is working > great. The weird issue I'm having is that the active responses sometimes > dont fire. > Its very intermittent because I get email spam for my Rule that is > supposed to trigger a null-route. I check the server's active-responses.log > and it shows no entries, though previously in the same day (couple hours > ago) I see entries for the same rule number. > > Any suggestions on helping determine why the ossec server couldnt spawn my > active response for the rule? > > Thank you, > Brian > > > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
