Configure OSSEC Email Alerts and the Alert Level

OSSEC is a host-based intrusion detection system (HIDS). It watches logs, file changes and other activity on a server and raises alerts. These are my notes for making OSSEC send those alerts by email.

Before you start

• OSSEC must already be installed. These steps use the default install folder, /var/ossec.

• You need root access (or sudo) to edit the file and restart OSSEC.

• You need an SMTP server that will accept mail from this machine: either a mail server on your network or a mail service (such as Postfix) running on the server itself.

• Make a backup of the config file before editing:

  cp /var/ossec/etc/ossec.conf /var/ossec/etc/ossec.conf.bak

1. Edit the config file

Edit the file /var/ossec/etc/ossec.conf:

vi /var/ossec/etc/ossec.conf

2. Turn on email notification

In the <global> section, change these settings:

<ossec_config>
    <global>
        <email_notification>yes</email_notification>
        <email_to>[email protected]</email_to>
        <smtp_server>mx.example.com..</smtp_server>
        <email_from>[email protected]</email_from>

Correction: the original had two dots at the end of the SMTP server name (mx.example.com..). That is a typo; the value should be just the host name or IP address of your mail server:

<smtp_server>mx.example.com</smtp_server>

What each setting does:

• email_notification: yes turns email alerts on.
• email_to: the address that receives the alerts.
• smtp_server: the mail server OSSEC sends through. If the server runs its own mail service, localhost works.
• email_from: the sender address shown on the alert emails.

These lines go inside the existing <global> section. Do not add a second <ossec_config> or <global> block; the snippet only shows where the settings sit. The file must stay valid XML, so every opening tag needs its closing tag.

3. Set the alert level

In the <alerts> section, set the minimum level that triggers an email:

<ossec_config>
    <alerts>
        <email_alert_level>10</email_alert_level>

OSSEC rules have levels from 0 to 15; higher numbers are more serious. With 10, only alerts at level 10 or above are emailed. A lower number sends more emails, a higher number sends fewer. As before, change the value inside the existing <alerts> section rather than adding a new one.

4. Restart the service

/var/ossec/bin/ossec-control restart

OSSEC only reads the config file when it starts, so the changes take effect after the restart.

How to check it worked

• Check that the OSSEC processes are running:

  /var/ossec/bin/ossec-control status

• Look in the OSSEC log for errors, for example a config mistake or a problem connecting to the SMTP server:

  tail -n 50 /var/ossec/logs/ossec.log

• Wait for an alert at or above your chosen level and check the inbox (and the spam folder).

Common mistakes

• A typo in the SMTP server name, like the extra dots above.
• The SMTP server refusing to relay mail from this machine.
• An alert level set so high that no alerts are ever sent.
• Breaking the XML (a missing closing tag), which stops OSSEC from starting. The restart output and ossec.log will show the error.

Notes for today

• The OSSEC project’s site is https://www.ossec.net/. Check its documentation for the version you run. Wazuh is a widely used fork of OSSEC with its own documentation; its settings differ in places, so follow the Wazuh docs if you use it.
• OSSEC’s smtp_server setting sends plain SMTP without a login. If your mail provider requires authentication, a common approach is to point OSSEC at a local mail service (such as Postfix) on the server and configure that to relay to your provider.