clean up ossec for RH