hi, On May 3, 12:30 pm, Andre Pawlowski <[email protected]> wrote: [...] > The regex is: > \[horde\] Error retrieving session data \(id = [a-f0-9]+\): Lock wait > timeout exceeded; try restarting transaction
The ossec regexp syntax is a bit different, check out: http://www.ossec.net/wiki/index.php/Know_How:Regex_Readme And you should test your rules with the ossec-logtest tool. > <rule id="500" level="10"> > <match>\[horde\] Error retrieving session data \(id = [a-f0-9]+\): > Lock wait timeout exceeded; try restarting transaction</match> > <options>alert_by_email</options> > <description>TEST</description> > </rule> > > But it doesn't fire. Any ideas? See above, also you should include something like <if_sid>1002</ if_sid>. regards, m
