{"action":"closed","issue":{"url":"https://api.github.com/repos/ossec/ossec-hids/issues/841","repository_url":"https://api.github.com/repos/ossec/ossec-hids","labels_url":"https://api.github.com/repos/ossec/ossec-hids/issues/841/labels{/name}","comments_url":"https://api.github.com/repos/ossec/ossec-hids/issues/841/comments","events_url":"https://api.github.com/repos/ossec/ossec-hids/issues/841/events","html_url":"https://github.com/ossec/ossec-hids/issues/841","id":154907459,"number":841,"title":"Questions about the response time of Ossec alarm rules.","user":{"login":"Canon88","id":19372121,"avatar_url":"https://avatars.githubusercontent.com/u/19372121?v=3","gravatar_id":"","url":"https://api.github.com/users/Canon88","html_url":"https://github.com/Canon88","followers_url":"https://api.github.com/users/Canon88/followers","following_url":"https://api.github.com/users/Canon88/following{/other_user}","gists_url":"https://api.github.com/users/Canon88/gists{/gist_id}","starred_url":"https://api.github.com/users/Canon88/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Canon88/subscriptions","organizations_url":"https://api.github.com/users/Canon88/orgs","repos_url":"https://api.github.com/users/Canon88/repos","events_url":"https://api.github.com/users/Canon88/events{/privacy}","received_events_url":"https://api.github.com/users/Canon88/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-05-15T12:58:10Z","updated_at":"2016-05-16T13:17:27Z","closed_at":"2016-05-16T13:17:27Z","body":"I used Ossec V2.8, \r\nTest rule is the ID 31310 in nginx_rules.xml.\r\nNow my question is,Using echo command manual simulation, triggering ossec alarm.\r\n\r\nFor example:\r\n**_echo echo '2016/05/10 09:26:27 [error] 44112#0: *173584487 open() \"/opt/nginx/html/favicon.ico\" failed (2: No such file or directory), client: 211.137.185.72, server: www.xxx.com, request: \"GET /favicon.ico HTTP/1.1\", host: \"www.xxx.com\"'>>/var/log/nginx_error.log_**\r\n\r\nBy observing the \"/var/ossec/logs/alerts/alerts.log\", I found that ossec does not display the alarm in real time. After the first warning rule is triggered, the next trigger rule is likely to be 30 seconds later.I do not understand why this is so。\r\nI was such a test, because I collected the nginx error log, refresh more frequently.\r\nWho can tell me why, thank you."}}