andrewsmhay/ossec2halo — pull request #1 by dead10ck (2014-01-31 18:39:26+00:00)
Title: More consistent selector for rules

A customer was having problems using policies which had more than one top-level group. The fix is that if there's more than one outer group, then they need to wrap them in one outer element, e.g.:

```xml

error: key_read: uudecode
Wrong or expired ssh keys.

can't open /etc/ntp/drift.TEMP
Please fix permission.

```
should be:
```xml

error: key_read: uudecode
Wrong or expired ssh keys.

can't open /etc/ntp/drift.TEMP
Please fix permission.

```
However, this requires the selector for the rules to be global, rather than specifically one level down from root.

I also changed the file to overwrite existing converted files, rather than appending.