Ah crap. It's the rule 554 level issue in the FAQ. Sorry for the noise. Isn't there a better solution to this than a FAQ entry?
The directive has the WORD "alert" in the string "alert_new_files" I'd think at this point the default should be level=7 and those few who *don't* want the behavior should change it to 0. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
