On Fri, Nov 25, 2016 at 7:42 AM, Johannes Lavre <johann...@vfk.no> wrote:

> Check if this is enabled in the config.
>
> SHOW_ALL_SIGNATURES
> If set to "Y" instructs psad to either include all scan signatures
> associated with an IP address in every new email alert for the IP. Note
> that this may result in long email alerts if an IP is persistantly hitting
> your site with suspicious traffic over a long period of time.
> SHOW_ALL_SIGNATURES is set to "N" by default and hence psad will only
> display alert information associate with new signatures.
> SHOW_ALL_SIGNATURES                 N;
>
> -----Opprinnelig melding-----
> Fra: Bill Hudacek [mailto:bill.huda...@gmail.com]
> Sendt: fredag 25. november 2016 06:05
> Til: psad-discuss@lists.sourceforge.net
> Emne: [psad-discuss] PSAD notifications
>
> Hvis du ikke √łnsker slike eposter i fremtiden vennligst benytt deg av
> avmeldingslinken vedlagt i eposten nedenfor.
> [apologies if this is a duplicate.  I subscribed, sent this note, and have
> not seen it - or any replies - nor any other traffic from the list. gmail
> is not putting anything from the list in the spam folder.
> Is this thing on?]
>

Sorry for the delayed response.


>
> I'm on CentOS 6.8 - knowing I need to update to get to v7.x... so I have
> psad-2.2.3-1.el6.i686.
>
> I was getting email notifications with this subject:
>
> [psad-status] added iptables auto-block against 1.2.3.4 for NN  seconds
>
> and
>
> [psad-status] removed iptables block against 1.2.3.4
>
> The emails are empty.
>
> Separately, I get DLn messages that include info on ports, whois info,
> etc.  These are welcomed.
>
> I managed to only disable the DLn messages - the opposite of what I
> intended.
>
> How can I only disable these empty notifications? I searched the mailing
> list before subscribing, but didn't see anything relevant.
>

Check out the ENABLE_AUTO_IDS_EMAILS variable in the psad.conf file.

Thanks,

--Mike



> --
> /Bill
>
> ------------------------------------------------------------
> ------------------
> _______________________________________________
> psad-discuss mailing list
> psad-discuss@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/psad-discuss
> ------------------------------------------------------------
> ------------------
> _______________________________________________
> psad-discuss mailing list
> psad-discuss@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/psad-discuss
>



-- 
Michael Rash | Founder
http://www.cipherdyne.org/
Key fingerprint = 53EA 13EA 472E 3771 894F  AC69 95D8 5D6B A742 839F
------------------------------------------------------------------------------
_______________________________________________
psad-discuss mailing list
psad-discuss@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/psad-discuss

Reply via email to