root wrote: > hi,all > > There is a problem，when some host make a different log,ossec can > associated and has False positives!
Not a bug, it's by design. It's called grouping. If you want to disable it, you need to add <do_not_group /> to your global email settings. http://www.ossec.net/doc/syntax/head_ossec_config.email_alerts.html#element-do_not_group -- --------------------------- Jason 'XenoPhage' Frisvold [email protected] --------------------------- "Any sufficiently advanced magic is indistinguishable from technology.\" - Niven's Inverse of Clarke's Third Law -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
