Hi Bill, On Fri, Jan 14, 2011 at 4:29 PM, Bill <[email protected]> wrote: > First and foremost, thanks to all who replied here. I'm backing off of the > directory ignores and just going with filenames in the regex ignore as those > seem to work more consistently. > > Shawn, I don't think that case and slash vs. backslash make a difference on > Windows. I can't be definitive though as I'm not one of the developers and > don't want to pretend to be one! My experience seems to be that they don't > matter though (on Windows) I think that the slash vs. backslash should > matter. > > I have only one last question, and it has to do with the regex. The wiki > says that I should use "\." to match any character. Shouldn't that be "." > to match any character and "\." to match a dot? > > Thanks again, all. This ossec newb appreciates all the comments that have > come in today. > > -Bill >
OSSEC's regex isn't exactly standard. The '.' vs. '\.' is "backwards" in OSSEC. '\.' is any character, the documentation is correct.
