Disabling Active Response
14 views
Skip to first unread message
Dave S
Mar 3, 2010, 10:00:03 AM3/3/10
to ossec-list
I recently added an additional <active_response> tag to my ossec.conf
file.
In order to test it, I wanted to disable the first active response, so
I added the <disabled>yes</disabled> tag to it.
ossec-execd saw the first active response was disabled and terminated
itself thinking that ALL active reponses were disabled (according to
what was in ossec.log).
file.
In order to test it, I wanted to disable the first active response, so
I added the <disabled>yes</disabled> tag to it.
ossec-execd saw the first active response was disabled and terminated
itself thinking that ALL active reponses were disabled (according to
what was in ossec.log).
Is this a bug?
Reply all
Reply to author
Forward
0 new messages