Hi, Can you try with the following snapshot:
http://www.ossec.net/files/snapshots/ossec-hids-080912.tar.gz It was a bug relating how we were parsing this specific syslog format (with the ip address following the hostname, instead of the program name). Thanks, -- Daniel B. Cid dcid ( at ) ossec.net On Mon, Sep 8, 2008 at 2:04 PM, simpsonlang <[EMAIL PROTECTED]> wrote: > > I have install Ossec 1.6 and am not able to get the decoder to work > for Aruba logs using the ossec-logtest. > > Thanks > > This is the local rule I'm using: > <rule id="100051" level="15"> > <match>is associating to a Rogue AP with SSID</match> > <if_fts /> > <description>Client Associating with Rogue AP Detected</ > description> > </rule> > > Log entry used: > Sep 8 16:44:53 aruba-controller.company.com [192.168.0.24] sapd[157]: > <106008> <ERRS> |AP [EMAIL PROTECTED] sapd| AM 00:0b:86:e1:df:00: > STA with MAC 00:17:f2:47:5f:0f is associating to a Rogue AP with SSID > Linksys Router and BSSID 00:18:39:cc:63:9f > > Ossec-logtest output: > Sep 8 16:44:53 aruba-controller.company.com [192.168.0.24] sapd[157]: > <106008> <ERRS> |AP [EMAIL PROTECTED] sapd| AM 00:0b:86:e1:df:00: > STA with MAC 00:17:f2:47:5f:0f is associating to a Rogue AP with SSID > Linksys Router and BSSID 00:18:39:cc:63:9f > > > **Phase 1: Completed pre-decoding. > full event: 'Sep 8 16:44:53 aruba-controller.company.com > [192.168.0.24] sapd[157]: <106008> <ERRS> |AP [EMAIL PROTECTED] > sapd| AM 00:0b:86:e1:df:00: STA with MAC 00:17:f2:47:5f:0f is > associating to a Rogue AP with SSID Linksys Router and BSSID > 00:18:39:cc:63:9f' > hostname: 'aruba-controller.company.com' > program_name: '' > log: '' > > **Phase 2: Completed decoding. > No decoder matched. >
