[ossec-list] Can't get OSSEC to fire active response for custom proftpd rule

[Steve West <stevewest15@xxxxxxxxx>]

Hi,

I'm trying to create a new proftpd rule in 
/var/ossec/rules/local_rules.xml but for some reason ossec is not 
performing the active response. Here is my rule:

<!-- Proftpd Rules -->

<group name="proftpd">
  <rule id="11000001" level="10" frequency="20" timeframe="60">   
    <if_matched_sid>11203</if_matched_sid>
    <same_source_ip />   
    <description>Multiple connection attempts using a non-existent 
user.</description>
  </rule>
</group>

<!-- End of Proftpd Rules -->

My rule is based on the /var/ossec/rules/proftpd_rules.xml rule id 11203:

  <rule id="11203" level="5">
    <if_sid>11200</if_sid>
    <match> no such user </match>
    <description>Attempt to login using a non-existent user.</description>
    <group>invalid_login,</group>
  </rule>

Am I doing something wrong as to why active response is not being 
invoked after 20 "no such user" in a 60 seconds time frame?

thx,

SW