Thank you, Javier. Your suggestion worked perfectly.
-b On Friday, October 26, 2018 at 9:20:45 PM UTC-7, [email protected] wrote: > > Hello Bummi, > I would say you need to create different* <reports>* tags for your > different needs: > > > > > > *<reports> <level>10</level> <title>Daily report: Alerts with level > higher than 10</title> <email_to>[email protected] > <javascript:></email_to></reports> * > > > > > > > *<reports> <group>syscheck</group> <title>Daily report: File > changes</title> <email_to>[email protected] <javascript:></email_to> > <rule>550</rule>* > *</reports>* > > *<reports>* > > > * <group>syscheck</group> <title>Daily report: File added to > system</title> <email_to>[email protected] <javascript:></email_to>* > > * <rule>554</rule> * > *</reports> * > > Hope that helps. > Regards, > > *Javier Castro* > IT Security Engineer — *Wazuh, Inc.* > > On Thursday, October 25, 2018 at 12:41:47 PM UTC-7, Bummi wrote: >> >> Hello! >> >> I am not getting daily reports emailed to me. Regular email alerts seems >> to work just fine. >> >> Here is my current configuration: >> >> <alerts> >> <log_alert_level>2</log_alert_level> >> <email_alert_level>10</email_alert_level> >> </alerts> >> >> <reports> >> <level>10</level> >> <title>Daily report: Alerts with level higher than 10</title> >> <email_to>[email protected]</email_to> >> <group>syscheck</group> >> <title>Daily report: File changes</title> >> <email_to>[email protected]</email_to> >> <rule>554</rule> >> <title>Daily report: File added to system</title> >> <email_to>[email protected]</email_to> >> </reports> >> >> >> >> >> I see this in my ossec-monitord logs for the level 10 report but nothing >> for the SYSCHECK or 554 report. I don't have any alerts higher than level >> 10 so I understand that this particular report will not be sent. >> >> 2018-10-25 00:00:16 | ossec-monitord | info | Report 'Daily report: >> Alerts with level higher than 10' completed and zero alerts >> post-filter. >> 2018-10-25 00:00:16 | ossec-monitord | info | Report 'Daily report: >> Alerts with level higher than 10' empty. >> 2018-10-25 00:00:11 | ossec-monitord | info | Starting new log after >> rotation. >> 2018-10-25 00:00:11 | ossec-monitord | info | Starting daily reporting >> for 'Daily report: Alerts with level higher than 10' >> I understand that reports run at midnight. Is there a way to force run >> them for testing purposes? >> >> Thanks, >> >> -r >> >> -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
