[ossec-list] Re: Ossec Problem: email_alert_level not being honored. Alert level 3 received in mail.

["Will Froning" <will.froning@xxxxxxxxx>]

Hello All,

On 7/25/07, Will Froning <will.froning@xxxxxxxxx> wrote:
> Hello All,
>
> Here's a "me too" message on this.  Server/agent with the most recent
> snapshot I could find running on Solaris 10.
>

I just confirmed that this is still happening with
ossec-hids-070722.tar.gz.  Any suggestions on tracking this down?

Thanks,
Will


> On 7/25/07, Clayton Dillard <cdillard@xxxxxxxxxxxxxxxxx> wrote:
> >
> > I too have this issue.  My ossec.conf file is the same as Frank's
> > (defaults) and yet I receive alerts daily that are at levels below 7.  I
> > have a server/agent setup.
> >
> > Thanks,
> >
> > - Cheers
> > Clayton Dillard
> >
> > Frank Spierings wrote:
> > > Hi people,
> > >
> > > I have a problem with my OSSEC server.
> > > The ossec.conf is pretty default. I only changed the email to address.
> > >
> > > This is the only alerts group in the file:
> > >   <alerts>
> > >     <log_alert_level>1</log_alert_level>
> > >     <email_alert_level>7</email_alert_level>
> > >   </alerts>
> > >
> > > Still I'm receiving "ossec agent started" emails from the server,
> > > which are level 3. I checked out the specific rule, but I dont see any
> > > indication why it should send me these mails.
> > > Any idea where I should start my quest?
> > >
> > > Thanks,
> > >
> > > Frank Spierings
> > >
> > >
> >
>
>
> --
> Will Froning
> Unix SysAdmin
> Will.Froning@xxxxxxxxx
> MSN: wfroning@xxxxxxxx
> YIM: will_froning
> AIM: willfroning
>


-- 
Will Froning
Unix SysAdmin
Will.Froning@xxxxxxxxx
MSN: wfroning@xxxxxxxx
YIM: will_froning
AIM: willfroning