I fairly new to ossec but I have been writing rules. The issue I have is 
that I have written a rule and tested it with ossec-logtest which seems to 
work. And the subject of the email I get has the correct hostname and alert 
level but there is no alert with that hostname or alert level in the body 
of the email message. I looked in /var/ossec/logs/alerts/alerts.log and 
there is the alert there with the correct log information, rule information 
and description, and the line from the logfile. What am I missing?

-- 

--- 
You received this message because you are subscribed to the Google Groups 
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to ossec-list+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Reply via email to