On 11/30/2015 12:21 PM, Daniel Bray wrote:
On Mon, Nov 30, 2015 at 11:26 AM, dan (ddp) <ddp...@gmail.com <mailto:ddp...@gmail.com>> wrote:Last idea at the moment: Copy archives.log. Open the copy in a text editor. Find an entry you want to test against and delete everything else. Delete the archives.log header from your chosen entry. Run that through ossec-logtest: `cat copy-of-archives.log | /var/ossec/bin/ossec-logtest` See if it still gets reported as a 0. Maybe there's some odd spacing issue that isn't maintained when copy/pasting it. Still gets reported as 0, but email is Level 2. --
Is this the only rule in your local_rules.xml that isn't working, or are all rules in your local_rules.xml not working?
----- You received this message because you are subscribed to the Google Groups "ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
smime.p7s
Description: S/MIME Cryptographic Signature