Re: [ossec-list] Re: Rule 1002 continues to fire after creating local overwriting rule

2016-04-20 Thread James Stallings
Service restarts did not clear the defunct process. I ended up killing them off and restarting. The server is healthy now and processing rules correctly. Thanks for all the help. On Wednesday, April 20, 2016 at 8:46:21 AM UTC-4, dan (ddpbsd) wrote: > > On Mon, Apr 18, 2016 at 5:46 PM, James Stal

Re: [ossec-list] Re: Rule 1002 continues to fire after creating local overwriting rule

2016-04-20 Thread dan (ddp)
On Mon, Apr 18, 2016 at 5:46 PM, James Stallings wrote: > I believe root cause here was a bunch of old OSSEC processes that were still > holding an older config in memory even after I had cycled the daemons on > several occasions. I no longer see the issue. Has anyone seen this sort of > behavior