[ossec-dev] root login rule stop working

[Louis Voo <jlvoo@xxxxxxxxx>]

Hi,

 

I used to receive email when root login to the system when I just installed Ossec, but now it stop working, what could be the problem? I can see this rule is still there

 

<group name="syslog,fts">
  <rule id="10100" level="4">
    <if_group>authentication_success</if_group>
    <options>alert_by_email</options>
    <if_fts></if_fts>
    <description>First time user logged in.</description>
  </rule>
</group>

 

 

Regards

Louis