TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems!
----------------------------------------------------------------------------
Greetings!
I have a User Defined Signature that worked in RS 3.2.1, but fails in RS 5.0.
Environment: ISS RS 5.0 XPU 1.3 Network Sensor on WinNT 4.0 SP6a with 512MB
and 30GB.
The signature that worked was in V3.2.1:
Context: URL_Data
Search String: /cgi-bin/ncommerce3/RMBRegisterForm\?merchant_rn=126
In V5.0, I can't get anything to match after the m in Form. After the m in
Form is an escaped question mark. If I try a dot (".") to match any character,
it won't even match! When I trim the search string to just the text before
the question mark, I can match. The logged data from the session playback is:
GET
/cgi-bin/ncommerce3/RMBRegisterForm?merchant_rn=126&shfield1=0000012345&option2=Register
HTTP/1.0
Referer: http://www.somehost.com/cgi-bin/ncommerce3/ExecMacro/Roche/register.d2w/report
Connection: Keep-Alive
... (more cut out)
I need to match out further to prevent false positives. I can't seem to match
out past the question mark in this version.
The regex'es I've tried include:
/cgi-bin/ncommerce3/RMBRegisterForm?m
/cgi-bin/ncommerce3/RMBRegisterForm\?m
/cgi-bin/ncommerce3/RMBRegisterForm.
/cgi-bin/ncommerce3/RMBRegisterForm.*m
Can anyone offer any help on User Defined Signatures and the use of a question
mark in the search string?
Thanks!
Steve
(Note, I've asked ISS Customer Support for help with this issue and here is
their response:
Hello Steve,
There have been some major changes to the product line from version 3.x to
version 5.0 but the underling code for regular expressions has not changed.
The context that works in version 3.x should work in all current versions of
RealSecure.
Please check the options to the right of the search string and ensure that
the event is enabled for Display and Logdb. Unfortunately, we cannot offer
assistance writing regular expressions. This URL may be useful to you:
http://virtual.park.uga.edu/humcomp/perl/regex2a.html
I hope that this helps.)
