[Ossec-list] Active response

[peter at ifup.de (Peter Ahlert)]

Hi,

I've got a problem with active response on a local system. I defined 

<active-response>
  <command>firewall-drop</command>
  <location>local</location>
  <level>6</level>
  <timeout>600</timeout>
</active-response>

but there is absolutely nothing in the log or in iptable -L. Any hint how to debug this?

Thx Peter

-- 
=========================================================================
	Peter Ahlert				 peter at ifup.de
==== We are Microsoft. You will be assimilated. Resistance is futile ====