Hey, I copy/pasted your decoder into a test environment and ran ossec-logtest. Here it seems to work fine:
2010/02/04 14:36:05 ossec-testrule: INFO: Started (pid: 31105).
ossec-testrule: Type one log per line.
Feb 1 15:51:45 192.168.1.1
**Phase 1: Completed pre-decoding.
full event: 'Feb 1 15:51:45 192.168.1.1'
hostname: 'myhost'
program_name: '(null)'
log: 'Feb 1 15:51:45 192.168.1.1'
**Phase 2: Completed decoding.
decoder: 'admail'
srcip: '192.168.1.1
