[ossec-list] Re: Can't get OSSEC to fire active response for custom proftpd rule

[Michael Starks <ossec@xxxxxxxxxxxxxxxxx>]

Steve West wrote:

> Am I doing something wrong as to why active response is not being 
> invoked after 20 "no such user" in a 60 seconds time frame?

Hello Steve,

I ran into a problem awhile back where it seemed like my rule wasn't 
working.  What I found after working with Daniel was that the behavior 
of OSSEC is to match just above the threshold.  So in your case the rule 
would not fire *on* 20, but at 21 (if memory serves me correctly).  Try 
21 or 22 invalid logins in 60 seconds.

-Mike