Greetings Xu Feng: RE: http://www.ossec.net/main/manual/#active-response
local = agent or local installation server = ossec server all = every ossec agent /var/ossec/active-response/ossec-hids-responses.log is the location of the log file that logs when active-response kicks off. If you want 5712 and 5720 only triggered on the ossec server, then use "server" rather than "local" Thank you.
