That's an issue in the current tree. Easy fix. Add the following decoder to decoders.xml or local_decoders.xml: <decoder name="ftp-proxy"> <decoded_as>^ftp-proxy</decoded_as> </decoder>
I think that's right, but I'm on my phone so there could be a tyop. On Oct 22, 2011 12:31 PM, "Joe S" <[email protected]> wrote: > On Sat, Oct 22, 2011 at 8:54 AM, dan (ddp) <[email protected]> wrote: > > Anything in ossec.log? > > > > This is what I get for posting before coffee. :-) > > > # cat ossec.log > 2011/10/22 08:31:43 ossec-testrule: INFO: Reading local decoder file. > 2011/10/22 08:31:43 ossec-analysisd: Invalid decoder name: 'ftp-proxy'. > 2011/10/22 08:31:43 ossec-testrule(1220): ERROR: Error loading the > rules: 'openbsd_rules.xml'. > 2011/10/22 08:33:11 ossec-testrule: INFO: Reading local decoder file. > 2011/10/22 08:33:11 ossec-analysisd: Invalid decoder name: 'ftp-proxy'. > 2011/10/22 08:33:11 ossec-testrule(1220): ERROR: Error loading the > rules: 'openbsd_rules.xml'. >
