Hi Sergey,
OSSEC has its own regex syntax, which is not fully compatible with the posix or
the perl. Yes, you can blame me for writting my own regex library :) The idea
was to do something very fast and simple, but over the time it expanded a
bit...
The following wiki entry explains what we support:
http://www.ossec.net/wiki/index.php/Know_How:Regex_Readme
Hope it helps.
--
Daniel B. Cid
dcid ( at ) ossec.net
On 2/2/07, Sergey Zhumatiy <[EMAIL PROTECTED]> wrote:
Hello!
Where can I find full syntax for ossec regexps? It seems to be not
fully compatible with POSIX and not fully compatible with perl...
Which symbols MUST be slashed, and which are not? Can I use '*'? And
so on...
--
With respect
Serg.
