The problem is my e-mail gets flooded by certain syslog errors, so I wrote
a custom rule to ignore these errors:
<rule id="100001" level="0">
<if_sid>1002</if_sid>
<match>MATCH</match>
<description>Ignore syslog errors</description>
</rule>
The funky thing is, ossec-logtest works as expected. That is: if I feed it
a line from syslog with MATCH in it, it fires rule 100001. However I still
get lots of e-mails for MATCH and rule 1002. Why is this? As of now ossec
is rendered useless because I receive way to much false positives.
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
