[ossec-list] Re: Alert message on the subject

[Pedro S]

Hi,

*I did not test it* but try the following:

Open the file /var/ossec/etc/internal_options.conf and modify the line (in 
your OSSEC Manager):

# Maild full subject (0=disabled, 1=enabled)
*maild.full_subject=1*

It seems like OSSEC has two different kind of subjects:

#define MAIL_SUBJECT "OSSEC Notification - %s - Alert level %d"
#define MAIL_SUBJECT_FULL "OSSEC Alert - %s - Level %d - %s"

And use them at os_maild_client.c 


I hope it helps!

Regards,

Pedro S.



On Tuesday, February 23, 2016 at 7:18:10 PM UTC+1, Jesus Linares wrote:



Hi,
>
> I think you can't change the subject. At least, I can't find anything 
> related to that in the documentation 
> .
>  
> What is your final goal?.
>
> Regards.
> Jesus Linares.
>
> On Tuesday, February 23, 2016 at 6:01:45 PM UTC+1, Junior Karvalho wrote:
>>
>> how do I add the alert message on the subject.
>>
>>
>>
>>
>>
>>
>> * Subject: OSSEC Notification - Alvin - level Alert 3 -> (ossec server 
>> started.)*
>>
>> OSSEC HIDS Notification.
>> 2016 Feb 23 13:35:53
>>
>> Received From: alvin->ossec-monitord
>> Rule: 502 fired (level 3) -> "Ossec server started."
>> Portion of the log(s):
>>
>> ossec: Ossec started.
>>
>>
>>
>>  --END OF NOTIFICATION
>>
>>
>>

-- 

--- 
You received this message because you are subscribed to the Google Groups 
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to ossec-list+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[ossec-list] Re: Alert message on the subject

[Jesus Linares]

Hi,

I think you can't change the subject. At least, I can't find anything 
related to that in the documentation 
.
 
What is your final goal?.

Regards.
Jesus Linares.

On Tuesday, February 23, 2016 at 6:01:45 PM UTC+1, Junior Karvalho wrote:
>
> how do I add the alert message on the subject.
>
>
>
>
>
>
> * Subject: OSSEC Notification - Alvin - level Alert 3 -> (ossec server 
> started.)*
>
> OSSEC HIDS Notification.
> 2016 Feb 23 13:35:53
>
> Received From: alvin->ossec-monitord
> Rule: 502 fired (level 3) -> "Ossec server started."
> Portion of the log(s):
>
> ossec: Ossec started.
>
>
>
>  --END OF NOTIFICATION
>
>
>

-- 

--- 
You received this message because you are subscribed to the Google Groups 
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to ossec-list+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.