[idmef-criteria] support at end node
It will be fine if this support exists since I have a lot of almost the same messages from all nodes about the same alert - successful login of backup user. It logs in frequently on all nodes so a lot of messages may be filtered without sending them to prelude-manager.
#2 Updated by Yoann VANDOORSELAERE over 12 years ago
- Status changed from New to Closed
- Resolution set to worksforme
Replying to [comment:1 yoann]:
Wouldn't a Prelude-LML pass rule, do what you are looking for?
By pass rule, I meant a "silent" rule:
regex=myregex; silent; last
Marking as workforme, please let us know if this doesn't solve your problem.