email - Single OSSEC rule to supress alert_by_email -
im trying supress/ignore alert_by_email-option every ossec-rule. documentation suggests following:
"some rules have option set force ossec sending alert email. option alert_by_email. 1 of these rules 1002. ignore these rules have create rule ignore it, or overwrite rule without alert_by_email option."
however not find example creating single role ignore option. hope guys can me.
add following rule in ossec/rules/local_rules.xml file:
add rule @ bottom of file make sure within <group>
tag.
<group> ... .. ... <rule id="1002" level="2" overwrite="yes"> <options>no_email_alert</options> <description>unknown problem somewhere in system.</description> </rule> </group>
this stop sending email alerts rule id=1002
Comments
Post a Comment