After installing OSSEC, and keeping default ossec.conf and all rules, what changes do I need to make so that OSSEC sends mail for multiple authentication failures, successful login after multiple authentication failures? I want OSSEC to send mail alerts when a user fails to login 4 times, and then logs in correctly the 5th time. What do I need modify? I've tried debugging, the failures log, but mail is not sent. So, I want to start from scratch.
-- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
