ossec2mysql debug log :
-----------------------
May 30 10:20:46 ossec2mysql: ACID_EVENT: ( INSERT INTO acid_event ( sid , cid , signature , sig_name , sig_class_id , sig_priority , timestamp , ip_src , ip_dst , ip_proto , layer4_sport , layer4_dport )
VALUES (
? , ? , ? , ? , ? , ? , ? , ? , ? , ? , ?, ?
) ,2,19506,44,'Ossec server started.',1,3,&fixdate2base(2007 May 30 10:20:45),3286046743,3286046743,undef,undef)
May 30 10:20:46 ossec2mysql: DATA: ( INSERT INTO data ( sid , cid , data_payload )
VALUES (
?,?,?),2,19506,** Alert 1180513245.2588560:      mail  - ossec,
2007 May 30 10:20:45 ml-manager -> ossec-monitord
Rule: 502 (level 3) -> 'Ossec server started.'
Src IP: (195.221.24.23)
User: (none)
ossec: Ossec started.)


BASE entry :
------------
** Alert 1180513245.2588560:	 mail  - ossec,
2007 May 30 10:20:45 ml-manager -> ossec-monitord
Rule: 502 (level 3) -> 'Ossec server started.'
Src IP: (0.0.0.0)
User: (none)
ossec: Ossec started.

====================================================
Notice how the IP changes !...