Re: [ossec-list] ossec-logtest returns Level 0 but still getting email alerts Level 2

[Ryan Schulze]

On 11/30/2015 12:21 PM, Daniel Bray wrote:

On Mon, Nov 30, 2015 at 11:26 AM, dan (ddp) <ddp...@gmail.com <mailto:ddp...@gmail.com>> wrote:

    Last idea at the moment:
    Copy archives.log. Open the copy in a text editor. Find an entry you
    want to test against and delete everything else.
    Delete the archives.log header from your chosen entry.
    Run that through ossec-logtest:
    `cat copy-of-archives.log | /var/ossec/bin/ossec-logtest`

    See if it still gets reported as a 0. Maybe there's some odd spacing
    issue that isn't maintained when copy/pasting it.


Still gets reported as 0, but email is Level 2.
--

--


To unsubscribe from this group and stop receiving emails from it, send an email 
to ossec-list+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Is this the only rule in your local_rules.xml that isn't working, or are all rules in your local_rules.xml not working? --- You received this message because you are subscribed to the Google Groups "ossec-list" group.

smime.p7s
Description: S/MIME Cryptographic Signature