OSSEC HIDS Notification. 2007 Apr 12 09:48:10 Received From: (scout) 192.168.2.3->WinEvtLog Rule: 11 fired (level 8) -> "Excessive number of events (above normal)." Portion of the log(s): The average number of logs between 9:00 and 10:00 is 27. We reached 88.