On Sun, Jan 27, 2013 at 6:37 PM, anthony kasza <[email protected]> wrote:
> Hello All,
>
> I have a local decoder that extracts fields correctly at phase 2 of
> the logtest from v2.6 that returns "No decoder matched" at phase 2 of
> the logtest from v2.7. My decoder and log line follow.
> <decoder name="conn">
> <program_name="conn"</program_name>
> </decoder>
> <decoder name="e-conn">
> <parent>conn</parent>
> <regex offset="after_parent">connection (\d+)</regex>
> <order>srcip</order>
> </decoder>
> Jan 12 12:12:12 hostname conn: connection 10
>
>
> I also noticed that the custom decoder and ForecField log entries here
> <http://www.ossec.net/doc/manual/rules-decoders/create-custom.html>
> are not properly extracted at phase 2 of the logtest in v2.7.
> Has anyone else had difficulties with local decoders between v2.6 and v2.7?
>
> -AK
>
> --
>
>
>
Nope.
This appears to be working for me. What output are you expecting?
# cat /tmp/x | /var/ossec/bin/ossec-logtest
2013/01/28 08:25:53 ossec-testrule: INFO: Reading local decoder file.
2013/01/28 08:25:54 ossec-testrule: INFO: Started (pid: 12220).
ossec-testrule: Type one log per line.
**Phase 1: Completed pre-decoding.
full event: 'Jan 12 12:12:12 hostname conn: connection 10'
hostname: 'hostname'
program_name: 'conn'
log: 'connection 10'
**Phase 2: Completed decoding.
No decoder matched.
# vi /var/ossec/etc/local_decoder.xml
# cat /tmp/x | /var/ossec/bin/ossec-logtest
2013/01/28 08:26:11 ossec-analysisd(1226): ERROR: Error reading XML
file 'etc/local_decoder.xml': XML ERR: Element not closed:
program_name="conn"</program_name (line 3).
2013/01/28 08:26:11 ossec-testrule(1202): ERROR: Configuration error
at '/etc/local_decoder.xml'. Exiting.
# vi /var/ossec/etc/local_decoder.xml
# cat /tmp/x | /var/ossec/bin/ossec-logtest
2013/01/28 08:26:39 ossec-testrule: INFO: Reading local decoder file.
2013/01/28 08:26:39 ossec-testrule: INFO: Started (pid: 16449).
ossec-testrule: Type one log per line.
**Phase 1: Completed pre-decoding.
full event: 'Jan 12 12:12:12 hostname conn: connection 10'
hostname: 'hostname'
program_name: 'conn'
log: 'connection 10'
**Phase 2: Completed decoding.
decoder: 'conn'
srcip: '10'
#
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group, send email to
[email protected].
For more options, visit https://groups.google.com/groups/opt_out.
