root wrote:
> hi,all
>
> There is a problem,when some host make a different log,ossec can
> associated and has False positives!
Not a bug, it's by design. It's called grouping. If you want to
disable it, you need to add <do_not_group /> to your global email settings.
http://www.ossec.net/doc/syntax/head_ossec_config.email_alerts.html#element-do_not_group
--
---------------------------
Jason 'XenoPhage' Frisvold
xeno...@godshell.com
---------------------------
"Any sufficiently advanced magic is indistinguishable from technology.\"
- Niven's Inverse of Clarke's Third Law