Skip to content

OSSEC HIDS v3.1.0 email alert does't show full alert messages #1571

@junqian1992

Description

@junqian1992

Email alert doesn't show the changes, but the alert.log is work.
Email alert

OSSEC HIDS Notification.
2018 Nov 12 16:01:49
Received From: (nagios-server185) xxxxxxx->syscheck
Rule: 550 fired (level 7) -> "Integrity checksum changed."
Portion of the log(s):
Integrity checksum changed for: '/home/hehe.txt'

--END OF NOTIFICATION

alerts.log

** Alert 1542009709.59473: mail - ossec,syscheck,
2018 Nov 12 16:01:49 (nagios-server185) xxxxxxx->syscheck
Rule: 550 (level 7) -> 'Integrity checksum changed.'
Integrity checksum changed for: '/home/hehe.txt'
Permissions changed from 'rwxr--r--' to 'rwxr-xr-x'

I found only some of the alert no show full message on email alert.
Example permission changed "chmod and chown".
The diff changed is working perfectly without problem on email alert.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions