nevermind, my bad, should be:
<rule id="100001" level="0">
<if_sid>1002</if_sid>
<program_name>MATCH</program_name>
<description>Ignore syslog errors</description>
</rule>
On Monday, 10 June 2013 09:58:41 UTC+2, Jeroen Beerstra wrote:
>
> The problem is my e-mail gets flooded by certain syslog errors, so I wrote
> a custom rule to ignore these errors:
>
> <rule id="100001" level="0">
> <if_sid>1002</if_sid>
> <match>MATCH</match>
> <description>Ignore syslog errors</description>
> </rule>
>
> The funky thing is, ossec-logtest works as expected. That is: if I feed it
> a line from syslog with MATCH in it, it fires rule 100001. However I still
> get lots of e-mails for MATCH and rule 1002. Why is this? As of now ossec
> is rendered useless because I receive way to much false positives.
>
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
