[ossec-list] Re: Customized Decoder

[Dave S]

Hi Eric,
First off, your entire regex is enclosed in square brackets which is
incorrect.
I'd try simplifying the regular expression to something like

<regex offset="after_parent">oip=(\d+.\d+.\d+.\d+);</regex>

Try that,
Dave