TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems! ----------------------------------------------------------------------------
Hi List, My first message to the list, good luck to me! I have defined a user-defined signature in my ServerSensor6.5, managed by workgroup manager. The user-defined signature raises an event when it sees the regular expression "security_event" in the log file. I am having trouble extracting other information from the txt file using the Name-Value pairs in the Info window. I cannot extract neither the @ Field N nor @StringN from the file. When the event happens, I can only see the string "@ Field 0" or "@String0" in the fields. Has anyone done this before? Are the Fields separated by tabs or spaces? Are Strings separated by enters? I also noticed that the regular expression is only detected when the carriage return character is hit (start new line). The RE is not detected when I enter "security_event blah" (without carriage return after blah). Is this behaviour normal? regards, Jack
