Hello Bummi, I would say you need to create different* <reports>* tags for your different needs:
*<reports> <level>10</level> <title>Daily report: Alerts with level higher than 10</title> <email_to>[email protected] <[email protected]></email_to></reports> * *<reports> <group>syscheck</group> <title>Daily report: File changes</title> <email_to>[email protected] <[email protected]></email_to> <rule>550</rule>* *</reports>* *<reports>* * <group>syscheck</group> <title>Daily report: File added to system</title> <email_to>[email protected] <[email protected]></email_to>* * <rule>554</rule> * *</reports> * Hope that helps. Regards, *Javier Castro* IT Security Engineer — *Wazuh, Inc.* On Thursday, October 25, 2018 at 12:41:47 PM UTC-7, Bummi wrote: > > Hello! > > I am not getting daily reports emailed to me. Regular email alerts seems > to work just fine. > > Here is my current configuration: > > <alerts> > <log_alert_level>2</log_alert_level> > <email_alert_level>10</email_alert_level> > </alerts> > > <reports> > <level>10</level> > <title>Daily report: Alerts with level higher than 10</title> > <email_to>[email protected] <javascript:></email_to> > <group>syscheck</group> > <title>Daily report: File changes</title> > <email_to>[email protected] <javascript:></email_to> > <rule>554</rule> > <title>Daily report: File added to system</title> > <email_to>[email protected] <javascript:></email_to> > </reports> > > > > > I see this in my ossec-monitord logs for the level 10 report but nothing > for the SYSCHECK or 554 report. I don't have any alerts higher than level > 10 so I understand that this particular report will not be sent. > > 2018-10-25 00:00:16 | ossec-monitord | info | Report 'Daily report: Alerts > with level higher than 10' completed and zero alerts post-filter. > 2018-10-25 00:00:16 | ossec-monitord | info | Report 'Daily report: Alerts > with level higher than 10' empty. > 2018-10-25 00:00:11 | ossec-monitord | info | Starting new log after > rotation. > 2018-10-25 00:00:11 | ossec-monitord | info | Starting daily reporting for > 'Daily report: Alerts with level higher than 10' > I understand that reports run at midnight. Is there a way to force run > them for testing purposes? > > Thanks, > > -r > > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
