> > Are you sure it was this log message that caused you to be locked out? > There is no information in that log message that could be used in an > active response. >
right, I just realized that the active-responses.log references the rule it was triggered from, in my case 40101 and the fact that I logged in as www. Ok, bad practice, no issue then. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
