Thank you for helping.
The delay is in "$ossec/logs/alerts/alerts.log", not email.
VS.
On Sat, 19 Oct 2013, Jared Greene wrote:
http://www.ossec.net/doc/syntax/head_ossec_config.email_alerts.html
Try... <do_not_delay />
Level 15 alerts from agent007 without delay or grouping:
<email_alerts>
<email_to>[email protected]</email_to>
<event_location>agent007</event_location>
<level>15</level>
<do_not_delay />
<do_not_group />
</email_alerts>
Thank you,
Jared R. Greene
(407) 414-4003
On Oct 19, 2013, at 2:15 PM, rim bulls <[email protected]> wrote:
Hello!
Excuse my English, it is not my native language.
Can someone help me with following issue:
Ossec verion: ossec-hids-local-2.7
OS: FreeBSD 8.3
Monitoring apache access log files. After running
OSSEC some time, ~10-20min., there appears delay between entry in log
file and
ossec generated alert.
Example:
** Alert 1380315612.1843: - apache-custom,
2013 Sep 28 00:00:12 mas->/var/log/web_access.log
Rule: 100288 (level 1) -> 'permit 404 "not found" '
Src IP: 83.136.136.54
www.besttech.lt 83.136.136.54 - - [27/Sep/2013:11:29:34 +0300] "GET
/ads/content/banner/20121025221552-3803.swf?clickTAG=http://www.besttech.lt/ads/?fwd=1811
HTTP/1.1" 403 244
"http://www.siesuks.lv/receptes/majas-trte-a-varito-kremu-207841/";
"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2;
.NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center
PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Alert is generated iin 2013 Sep 28 00:00:12, log file entry
27/Sep/2013:11:29:34.
As longer OSSEC runs, the delay gets larger.
I searched for answer using search engines, but did not get any
answer. Can someone provide me some useful information, so I can
resolve this case, please.
Kind regards.
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
--
---
You received this message because you are subscribed to the Google Groups "ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
