[ossec-list] Decoder problems

[Gnowar]

Hello,

I have some troubles with my new decoder (I wrote a new one cause my
format logs wasn't interpreted).

Here is my format log :

"Feb 1 15:51:45 hostname.domain MSWinEventLog 1 Security 24510 Mon:
Feb 01 15:51:43 2010 538 Security name User Success Audit AD-MAIL01
Ouverture/Fermeture de session Fermeture de la session utilisateur :
Utilisateur : name Domaine : domain Id. de la session :
(0x0,0x1054E9D) Type de session : 3 23444"

For my firts tests, I'm just trying with :

Feb 1 15:51:45 192.68.1.1

Here is my decoder :

<decoder name="admail">
  <prematch>^\w\w\w \d+ \d\d:\d\d:\d\d</prematch>
  <regex offset="after_prematch">^ (\d+.\d+.\d+.\d+)</regex>
  <order>srcip</order>
</decoder>

As you see it's a very simple one, but when I test it with ossec-
logtest I have the following output :

Feb 1 15:51:45 192.168.1.1


**Phase 1: Completed pre-decoding.
       full event: 'Feb 1 15:51:45 192.168.1.1'
       hostname: 'Template'
       program_name: '(null)'
       log: 'Feb 1 15:51:45 192.168.1.1'

**Phase 2: Completed decoding.
       decoder: 'admail'
       extra_data: '1'
       extra_data: '2'

Do you have any idea ? I just took an example from this explanation,
but it doesn't work neither.

Am I missing something ?

Thanks