I just installed erm OSSEC, well not just but like 4 days ago and most of the notifications that i get are containing this: Same IP address all the time. I get like 10 emails per day for this thing.. I also blocked his IP on hardware firewall and in firewall it detects Back Orifice attacks which are blocked.. Should i ignore this or what? Erm, the error tells that he's trying to execute FP stuff..
If it's always the same IP address, you can block it like this: http://www.howtoforge.com/forums/showpost.php?p=38142&postcount=4
