Re: [ossec-list] Problem with dovecot decoder

Hi, I am using ossec 2.8.3, but in 2.9.0 dovecot-aborted decoder was fixed, thanks. Regards -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to

Re: [ossec-list] Problem with dovecot decoder

Hi, what fields do you need?. Dec 19 17:20:08 ny dovecot: pop3-login: Aborted login (auth failed, 2 attempts in 18 secs): *user*=, method=PLAIN, *rip*=1.2.3.4, *lip*=1.2. 3.4, session= **Phase 1: Completed pre-decoding. full event: 'Dec 19 17:20:08 ny dovecot: pop3-login: Aborted login

[ossec-list] Problem with dovecot decoder

Hi all, have problem with dovecot decoder Example log: Dec 19 17:20:08 ny dovecot: pop3-login: Aborted login (auth failed, 2 attempts in 18 secs): user=, method=PLAIN, rip=1.2.3.4, lip=1.2.3.4, session= Default dovecot decoder dovecot ^\w\w\w\w-login: Aborted login : user=\p(\S+)\p,