On Mon, Nov 30, 2015 at 11:26 AM, dan (ddp) <[email protected]> wrote: > > > Last idea at the moment: > Copy archives.log. Open the copy in a text editor. Find an entry you > want to test against and delete everything else. > Delete the archives.log header from your chosen entry. > Run that through ossec-logtest: > `cat copy-of-archives.log | /var/ossec/bin/ossec-logtest` > > See if it still gets reported as a 0. Maybe there's some odd spacing > issue that isn't maintained when copy/pasting it. > > Still gets reported as 0, but email is Level 2.
-- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
