hook [smtp] and idmef-criteria-filter

Hello,

I'm trying to test the example posted in the wiki bellow in [1]. And
the [smtp] module isn't instantiated [2]. When  I try to forward
(hook) to another module, TextMod for example, the filter doesn't
suppress or limit the number of messages.

Any suggestions ?


[1]
Filter configuration

[smtp]
sender = [email protected]
recipients = [email protected]
smtp-server = mailserver.mycompanyname.com

[thresholding=sudotest]
path = alert.classification.text, alert.target(0).node.address(0).address
threshold = 1
seconds = 3600
hook = smtp[default]

[idmef-criteria-filter=sudotest]
rule = alert.classification.text == 'SUDO Command Executed'
hook = thresholding[sudotest]

[2]

INFO: Subscribing db[default] to active reporting plugins.
INFO: Subscribing TextMod[default] to active reporting plugins.


Thanks
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user