<time>11:00 am - 12:00 pm</time> should be valid. It produces the errors (in ossec-logtest) (this is NOT copy/pasted, so there are possible typos): ERROR: Invalid time format: 'm' ERROR: Invalid configuration, Element 'time': 11:00 am - 12:00 pm. <time>11:00 am - 12:00 p</time> gives us: ERROR: Invalid time format: ''. <time>11:00 - 12:00</time> works just fine. I assume all 24h entries would work, but this is untested (can test in a few hours if necessary). Reported by Nguyễn Văn Hớn (honit92 a gmail) on the user's list.