[ossec-list] decoder problems

[dthfoo]

Hey!

I am trying to write a custom decoder for our checkpoint logs and am
running into difficulty trying to get parent->child decoders working.

I have ended up writing a test decoder as follows;

<decoder name="test-syslog">
  <prematch>^test</prematch>
</decoder>

<decoder name="test-syslog-remainder">
  <parent>test-syslog</parent>
  <use_own_name>true</use_own_name>
  <prematch offset="after_parent">\.*</prematch>
</decoder>

Then I used "logtest" to test the following 2 inputs;
"test"
"test test"

I expected that the first input would be matched to the parent decoder
and the second input to the child. Instead I get the following;

2009/09/29 13:41:55 ossec-testrule: INFO: Started (pid: 31027).
ossec-testrule: Type one log per line.

test


**Phase 1: Completed pre-decoding.
       full event: 'test'
       hostname: 'plukinfra1'
       program_name: '(null)'
       log: 'test'

**Phase 2: Completed decoding.
       decoder: 'test-syslog'
test test


**Phase 1: Completed pre-decoding.
       full event: 'test test'
       hostname: 'plukinfra1'
       program_name: '(null)'
       log: 'test test'

**Phase 2: Completed decoding.
       decoder: 'test-syslog'


Is my thinking faulty or does the problem lie somewhere else?

Cheers,

Dan.