I changed line 74 in /ossec-hids-1.3/src/logcollector/read_snortfull.c to correct this, I'm not sure it's the best solution to the issue but it fixed my problem and so far hasn't introduced any new issues.
to: else if(((str[2] == '/')&&(str[5] == '-')&&(q = strchr(str,' '))) || (str[0] == '[')) -- Zac Roetemeyer [EMAIL PROTECTED]
