[ossec-list] Re: Can't get OSSEC to fire active response for custom proftpd rule

["Daniel Cid" <daniel.cid@xxxxxxxxx>]

Hi Steve,

Are the alerts being generated based on your rule? If yes, can you
show us the output of them? (from /var/ossec/logs/alerts.log ). You
need to make sure that the srcip is present
in the alert (meaning that it was decoded properly), otherwise the
active response is not
going to fire.

Thanks,

--
Daniel B. Cid
dcid ( at ) ossec.net

On 10/24/07, Steve West <stevewest15@xxxxxxxxx> wrote:
>
> Michael Starks wrote:
> > Try 21 or 22 invalid logins in 60 seconds.
> >
> > -Mike
> >
> Hi Mike,
>
> Thanks for the suggestion! I try over 25 invalid logins and still ossec
> active response doesn't fire. Not really sure why but I think it might
> be related to my rule or the underlaying proftpd group rule 11200.
>
> SW
>