On 11/30/2015 12:21 PM, Daniel Bray wrote:
On Mon, Nov 30, 2015 at 11:26 AM, dan (ddp) <[email protected]
<mailto:[email protected]>> wrote:
Last idea at the moment:
Copy archives.log. Open the copy in a text editor. Find an entry you
want to test against and delete everything else.
Delete the archives.log header from your chosen entry.
Run that through ossec-logtest:
`cat copy-of-archives.log | /var/ossec/bin/ossec-logtest`
See if it still gets reported as a 0. Maybe there's some odd spacing
issue that isn't maintained when copy/pasting it.
Still gets reported as 0, but email is Level 2.
--
Is this the only rule in your local_rules.xml that isn't working, or are all rules in your local_rules.xml not working?
----- You received this message because you are subscribed to the Google Groups "ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
smime.p7s
Description: S/MIME Cryptographic Signature
