On Fri, Aug 2, 2013 at 11:19 AM, David Blanton <[email protected]> wrote: >> >> >No, but agents don't do anything with alerts so that shouldn't surprise >> > anyone >> >> Where should I be looking to address this issue? I'm not seeing duplicate >> maild pids on my server and ossec.conf is error free. > > > It seems that during email alerts - the original alert is sent, then the > duplicate alert is in 'quotations'/so it's a copy. Is this a feature built > into OSSEC? >
That doesn't sound like a feature. It also doesn't make sense. Where in your example are these quotations? Is there a timestamp for these log messages? Are you sure they aren't duplicated in the log file? Are there multiple ossec-agentd processes running on the agent? Multipe logcollector processes? > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/groups/opt_out. > > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
