Some of the out-of-the-box rules include an 'alert_by_email' option so that you receive an e-mail regardless of the level chosen in your ossec.conf. Reference: http://www.ossec.net/doc/faq/alerts.html#i-set-the-email-alert-level-to-10-why-do-i-keep-seeing-rules-with-lower-levels
If the above is not the answer to your issue, can you please provide some of the rule ids you are experiencing this issue with? On Nov 30, 2012, at 5:04 PM, Matt Hargrave <c130comm...@gmail.com> wrote: > I just upgraded to 2.7 Release on my server (agents are still running 2.6). > I am getting email alerts on all alert level despite the default > configuration of 7: > > <alerts> > <log_alert_level>1</log_alert_level> > <email_alert_level>7</email_alert_level> > </alerts> > >
