{"action":"created","issue":{"url":"https://api.github.com/repos/wazuh/wazuh/issues/1281","repository_url":"https://api.github.com/repos/wazuh/wazuh","labels_url":"https://api.github.com/repos/wazuh/wazuh/issues/1281/labels{/name}","comments_url":"https://api.github.com/repos/wazuh/wazuh/issues/1281/comments","events_url":"https://api.github.com/repos/wazuh/wazuh/issues/1281/events","html_url":"https://github.com/wazuh/wazuh/issues/1281","id":358866807,"node_id":"MDU6SXNzdWUzNTg4NjY4MDc=","number":1281,"title":"Keep receiving email alerts at all levels while set at 10 , why?","user":{"login":"2A806","id":40019435,"node_id":"MDQ6VXNlcjQwMDE5NDM1","avatar_url":"https://avatars2.githubusercontent.com/u/40019435?v=4","gravatar_id":"","url":"https://api.github.com/users/2A806","html_url":"https://github.com/2A806","followers_url":"https://api.github.com/users/2A806/followers","following_url":"https://api.github.com/users/2A806/following{/other_user}","gists_url":"https://api.github.com/users/2A806/gists{/gist_id}","starred_url":"https://api.github.com/users/2A806/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/2A806/subscriptions","organizations_url":"https://api.github.com/users/2A806/orgs","repos_url":"https://api.github.com/users/2A806/repos","events_url":"https://api.github.com/users/2A806/events{/privacy}","received_events_url":"https://api.github.com/users/2A806/received_events","type":"User","site_admin":false},"labels":[{"id":246680129,"node_id":"MDU6TGFiZWwyNDY2ODAxMjk=","url":"https://api.github.com/repos/wazuh/wazuh/labels/question","name":"question","color":"cc317c","default":true}],"state":"open","locked":false,"assignee":{"login":"TJOSERAFAEL","id":16609513,"node_id":"MDQ6VXNlcjE2NjA5NTEz","avatar_url":"https://avatars2.githubusercontent.com/u/16609513?v=4","gravatar_id":"","url":"https://api.github.com/users/TJOSERAFAEL","html_url":"https://github.com/TJOSERAFAEL","followers_url":"https://api.github.com/users/TJOSERAFAEL/followers","following_url":"https://api.github.com/users/TJOSERAFAEL/following{/other_user}","gists_url":"https://api.github.com/users/TJOSERAFAEL/gists{/gist_id}","starred_url":"https://api.github.com/users/TJOSERAFAEL/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/TJOSERAFAEL/subscriptions","organizations_url":"https://api.github.com/users/TJOSERAFAEL/orgs","repos_url":"https://api.github.com/users/TJOSERAFAEL/repos","events_url":"https://api.github.com/users/TJOSERAFAEL/events{/privacy}","received_events_url":"https://api.github.com/users/TJOSERAFAEL/received_events","type":"User","site_admin":false},"assignees":[{"login":"TJOSERAFAEL","id":16609513,"node_id":"MDQ6VXNlcjE2NjA5NTEz","avatar_url":"https://avatars2.githubusercontent.com/u/16609513?v=4","gravatar_id":"","url":"https://api.github.com/users/TJOSERAFAEL","html_url":"https://github.com/TJOSERAFAEL","followers_url":"https://api.github.com/users/TJOSERAFAEL/followers","following_url":"https://api.github.com/users/TJOSERAFAEL/following{/other_user}","gists_url":"https://api.github.com/users/TJOSERAFAEL/gists{/gist_id}","starred_url":"https://api.github.com/users/TJOSERAFAEL/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/TJOSERAFAEL/subscriptions","organizations_url":"https://api.github.com/users/TJOSERAFAEL/orgs","repos_url":"https://api.github.com/users/TJOSERAFAEL/repos","events_url":"https://api.github.com/users/TJOSERAFAEL/events{/privacy}","received_events_url":"https://api.github.com/users/TJOSERAFAEL/received_events","type":"User","site_admin":false}],"milestone":null,"comments":2,"created_at":"2018-09-11T02:51:42Z","updated_at":"2018-09-13T02:37:34Z","closed_at":null,"author_association":"NONE","body":"Keep receiving email alerts at all levels while set at 10 , why?\r\n\r\nthis is my config , please help \r\n\r\n  ```\r\n<global>\r\n    <jsonout_output>yes</jsonout_output>\r\n    <alerts_log>yes</alerts_log>\r\n    <logall>no</logall>\r\n    <logall_json>no</logall_json>\r\n    <email_notification>yes</email_notification>\r\n    <smtp_server>localhost</smtp_server>\r\n    <email_from>xxx@xxx.com</email_from>\r\n    <email_to>xxx@xxx</email_to>\r\n    <email_maxperhour>12</email_maxperhour>\r\n    <queue_size>131072</queue_size>\r\n  </global>\r\n\r\n  <alerts>\r\n    <log_alert_level>3</log_alert_level>\r\n    <email_alert_level>10</email_alert_level>\r\n  </alerts>\r\n```"},"comment":{"url":"https://api.github.com/repos/wazuh/wazuh/issues/comments/420863672","html_url":"https://github.com/wazuh/wazuh/issues/1281#issuecomment-420863672","issue_url":"https://api.github.com/repos/wazuh/wazuh/issues/1281","id":420863672,"node_id":"MDEyOklzc3VlQ29tbWVudDQyMDg2MzY3Mg==","user":{"login":"2A806","id":40019435,"node_id":"MDQ6VXNlcjQwMDE5NDM1","avatar_url":"https://avatars2.githubusercontent.com/u/40019435?v=4","gravatar_id":"","url":"https://api.github.com/users/2A806","html_url":"https://github.com/2A806","followers_url":"https://api.github.com/users/2A806/followers","following_url":"https://api.github.com/users/2A806/following{/other_user}","gists_url":"https://api.github.com/users/2A806/gists{/gist_id}","starred_url":"https://api.github.com/users/2A806/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/2A806/subscriptions","organizations_url":"https://api.github.com/users/2A806/orgs","repos_url":"https://api.github.com/users/2A806/repos","events_url":"https://api.github.com/users/2A806/events{/privacy}","received_events_url":"https://api.github.com/users/2A806/received_events","type":"User","site_admin":false},"created_at":"2018-09-13T02:37:34Z","updated_at":"2018-09-13T02:37:34Z","author_association":"NONE","body":"Hi @TJOSERAFAEL ,\r\nproblem solved ! the reason i kept receiving email alerts at all levels while set at 10 is because some rule files have option like this \r\n```\r\n<rule id=\"31122\" level=\"5\">\r\n    <if_sid>31120</if_sid>\r\n    <id>^500</id>\r\n    <options>alert_by_email</options>\r\n    <description>Web server 500 error code (Internal Error).</description>\r\n    <group>system_error,</group>\r\n</rule> \r\n``` \r\nand `<options>alert_by_email</options>` means send email alerts disregarding the trigger level you have set .\r\n\r\n"}}
{"actor":{"display_login":"2A806"}}