Re: [ossec-list] I'd like to ignore these...

Thanks very much! On 08/23/2014 06:29 AM, Binet, Valere (NIH/NIA/IRP) [C] wrote: > write a local rule in /var/ossec/rules/local_rules.xml > > Your rule should look more or less like this > > 1002 > AH01797 >Ignore AH01797 messages > > > replace 11 with the next ava

RE: [ossec-list] I'd like to ignore these...

write a local rule in /var/ossec/rules/local_rules.xml Your rule should look more or less like this 1002 AH01797 Ignore AH01797 messages replace 11 with the next available ID if 11 is already used by another rule. Hoping this helps. Valere _