[ossec-list] Re: Ossec Problem: email_alert_level not being honored. Alert level 3 received in mail.

["Will Froning" <will.froning@xxxxxxxxx>]

Hello Daniel,

On 7/26/07, Daniel Cid <daniel.cid@xxxxxxxxx> wrote:
>
> Hey,
>
> If I am not misunderstanding the problem, this is not a bug on ossec,
> but it happens because some rules have:
>
> <options>alert_by_email</options>
>
> to bypass the default e-mail alerting level.
>
> Check out:
> http://www.ossec.net/ossec-list/2007-July/msg00034.html
> http://www.ossec.net/ossec-list/2007-July/msg00035.html
>
> If that's not it, let me know and we can try to figure out what is happening...
>

That was it.  My bad.  So I found one of the offending rules in
rules/msauth_rules.xml.  How would I go about disabling it for just
one server?

The example is, we have a terminal server where potentially over 1000
new users may use it in a semester.  For these types of servers it
wouldn't provide any additional information to send me 1000 of the
below messages as it's normal:

Received From: (termsrv1) 192.168.35.40->WinEvtLog
Rule: 18119 fired (level 3) -> "First time this user logged in this system."

This is a Solaris 10 server with W2k3 agent.

The manual and list archives didn't clue me in, so any help would be great.

Thanks,
Will

> Thanks,
>
> --
> Daniel B. Cid
> dcid ( at ) ossec.net
>
>
> On 7/25/07, Will Froning <will.froning@xxxxxxxxx> wrote:
> >
> > Hello All,
> >
> > On 7/25/07, Will Froning <will.froning@xxxxxxxxx> wrote:
> > > Hello All,
> > >
> > > Here's a "me too" message on this.  Server/agent with the most recent
> > > snapshot I could find running on Solaris 10.
> > >
> >
> > I just confirmed that this is still happening with
> > ossec-hids-070722.tar.gz.  Any suggestions on tracking this down?
> >
> > Thanks,
> > Will
> >
> >
> > > On 7/25/07, Clayton Dillard <cdillard@xxxxxxxxxxxxxxxxx> wrote:
> > > >
> > > > I too have this issue.  My ossec.conf file is the same as Frank's
> > > > (defaults) and yet I receive alerts daily that are at levels below 7.  I
> > > > have a server/agent setup.
> > > >
> > > > Thanks,
> > > >
> > > > - Cheers
> > > > Clayton Dillard
> > > >
> > > > Frank Spierings wrote:
> > > > > Hi people,
> > > > >
> > > > > I have a problem with my OSSEC server.
> > > > > The ossec.conf is pretty default. I only changed the email to address.
> > > > >
> > > > > This is the only alerts group in the file:
> > > > >   <alerts>
> > > > >     <log_alert_level>1</log_alert_level>
> > > > >     <email_alert_level>7</email_alert_level>
> > > > >   </alerts>
> > > > >
> > > > > Still I'm receiving "ossec agent started" emails from the server,
> > > > > which are level 3. I checked out the specific rule, but I dont see any
> > > > > indication why it should send me these mails.
> > > > > Any idea where I should start my quest?
> > > > >
> > > > > Thanks,
> > > > >
> > > > > Frank Spierings
> > > > >
> > > > >
> > > >
> > >
> > >
> > > --
> > > Will Froning
> > > Unix SysAdmin
> > > Will.Froning@xxxxxxxxx
> > > MSN: wfroning@xxxxxxxx
> > > YIM: will_froning
> > > AIM: willfroning
> > >
> >
> >
> > --
> > Will Froning
> > Unix SysAdmin
> > Will.Froning@xxxxxxxxx
> > MSN: wfroning@xxxxxxxx
> > YIM: will_froning
> > AIM: willfroning
> >
>


-- 
Will Froning
Unix SysAdmin
Will.Froning@xxxxxxxxx
MSN: wfroning@xxxxxxxx
YIM: will_froning
AIM: willfroning