On Mon, Nov 30, 2015 at 5:28 PM, Ryan Schulze <[email protected]> wrote:
> > Is this the only rule in your local_rules.xml that isn't working, or are > all rules in your local_rules.xml not working? > > So far, this is the only rule that I just can't seem to stop emailing. I have other rules, and when I check them against ossec-logtest, they come back as "Level: 0", which I've correctly configured. I wait, and no email alerts come in, which is the expected behavior. In fact, I have about 12 rules filtering out various known issues. It's just this one that will not stop emailing, and wouldn't you know it, it is rather a common "alert" that comes in a few hundred times a day. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
