Hey, anyone hacked/tested a workaround for this issue - caching/releasing? For example by logging into native MS event log in order to process it later via MS event subscription or caching syslog agent?
V anyway, remember that the agents send the alerts in real time. *Alerts are > not stored to be sent later*. So, you are not going to receive the alerts > generated in your agents when they were not connected to the Manager > network. > > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
