[ossec-list] Re: Ossec Problem: email_alert_level not being honored. Alert level 3 received in mail.

["Daniel Cid" <daniel.cid@xxxxxxxxx>]

Hey,

If I am not misunderstanding the problem, this is not a bug on ossec,
but it happens because some rules have:

<options>alert_by_email</options>

to bypass the default e-mail alerting level.

Check out:
http://www.ossec.net/ossec-list/2007-July/msg00034.html
http://www.ossec.net/ossec-list/2007-July/msg00035.html

If that's not it, let me know and we can try to figure out what is happening...

Thanks,

--
Daniel B. Cid
dcid ( at ) ossec.net


On 7/25/07, Will Froning <will.froning@xxxxxxxxx> wrote:
>
> Hello All,
>
> On 7/25/07, Will Froning <will.froning@xxxxxxxxx> wrote:
> > Hello All,
> >
> > Here's a "me too" message on this.  Server/agent with the most recent
> > snapshot I could find running on Solaris 10.
> >
>
> I just confirmed that this is still happening with
> ossec-hids-070722.tar.gz.  Any suggestions on tracking this down?
>
> Thanks,
> Will
>
>
> > On 7/25/07, Clayton Dillard <cdillard@xxxxxxxxxxxxxxxxx> wrote:
> > >
> > > I too have this issue.  My ossec.conf file is the same as Frank's
> > > (defaults) and yet I receive alerts daily that are at levels below 7.  I
> > > have a server/agent setup.
> > >
> > > Thanks,
> > >
> > > - Cheers
> > > Clayton Dillard
> > >
> > > Frank Spierings wrote:
> > > > Hi people,
> > > >
> > > > I have a problem with my OSSEC server.
> > > > The ossec.conf is pretty default. I only changed the email to address.
> > > >
> > > > This is the only alerts group in the file:
> > > >   <alerts>
> > > >     <log_alert_level>1</log_alert_level>
> > > >     <email_alert_level>7</email_alert_level>
> > > >   </alerts>
> > > >
> > > > Still I'm receiving "ossec agent started" emails from the server,
> > > > which are level 3. I checked out the specific rule, but I dont see any
> > > > indication why it should send me these mails.
> > > > Any idea where I should start my quest?
> > > >
> > > > Thanks,
> > > >
> > > > Frank Spierings
> > > >
> > > >
> > >
> >
> >
> > --
> > Will Froning
> > Unix SysAdmin
> > Will.Froning@xxxxxxxxx
> > MSN: wfroning@xxxxxxxx
> > YIM: will_froning
> > AIM: willfroning
> >
>
>
> --
> Will Froning
> Unix SysAdmin
> Will.Froning@xxxxxxxxx
> MSN: wfroning@xxxxxxxx
> YIM: will_froning
> AIM: willfroning
>