[ossec-list] Re: Question about local_rules regex matching

[Kayvan A. Sylvan]

On Sun, Nov 02, 2008 at 06:22:40PM -0500, Bryan Jacobs wrote:
> 
> Try this:
> 
>   <rule id="100050" level="0">
>     <if_sid>1002</if_sid>
>     <program_name>^dovecot</program_name>
>     <match>Corrupted index cache file </match>
>     <options>no_email_alert</options>
>     <description>Ignore dovecot index corruption messages</description>

Thanks! I modified my rules according to this pattern.