I used a snapshot from 01/29/2010: $: cat /etc/ossec-init.conf
DIRECTORY="/var/ossec" VERSION="2.4-SNP-100129" DATE="Thu Feb 4 14:29:08 CET 2010" TYPE="local" Maybe your problem is some character encoding or some non-ascii characters that accidentaly went into your decoder. Try rewriting it. Apart from that I have no idea how to solve the problem. On Thu, Feb 4, 2010 at 3:46 PM, Gnowar <[email protected]> wrote: > Damn, which version do you use ? > > I'm using v2.3 ! > > Any solution except a new installation of OSSEC ? > > Thanks ! > > On 4 fév, 14:38, oscar schneider <[email protected]> wrote: > > Hey, > > > > I copy/pasted your decoder into a test environment and ran ossec-logtest. > > Here it seems to work fine: > > > > 2010/02/04 14:36:05 ossec-testrule: INFO: Started (pid: 31105). > > ossec-testrule: Type one log per line. > > > > Feb 1 15:51:45 192.168.1.1 > > > > **Phase 1: Completed pre-decoding. > > full event: 'Feb 1 15:51:45 192.168.1.1' > > hostname: 'myhost' > > program_name: '(null)' > > log: 'Feb 1 15:51:45 192.168.1.1' > > > > **Phase 2: Completed decoding. > > decoder: 'admail' > > srcip: '192.168.1.1 >
