On Mon, Jul 1, 2013 at 10:52 AM, David Blanton
<[email protected]> wrote:
> Ideally, I would like the decoder to just look for 'FAILED : '
>
> could it also be like this?
>
> <decoder name="bnc">
> <prematch>FAILED : \d+</prematch>
>
> </decoder>
>
Both of these decoders are bad. The first one didn't have an "<order>"
after the regex, and this one is way too broad IMO.
With the limited sample size, I've gotten this to work:
<decoder name="bnc-decoder">
<prematch>^\d+-\d+: \S+ \d+-\d+ \d+-\d+ \S+ </prematch>
<regex offset="after_prematch">^(\S+): \S(\d+)$</regex>
<order>status, extra_data</order>
</decoder>
2013/07/01 11:24:32 ossec-testrule: INFO: Reading local decoder file.
2013/07/01 11:24:32 ossec-testrule: INFO: Started (pid: 25839).
ossec-testrule: Type one log per line.
**Phase 1: Completed pre-decoding.
full event: '119445-00025: P31128449pdf9030215.zip 0312-3
11-28449 pdf903 FAILED: -351'
hostname: 'arrakis'
program_name: '(null)'
log: '119445-00025: P31128449pdf9030215.zip 0312-3 11-28449
pdf903 FAILED: -351'
**Phase 2: Completed decoding.
decoder: 'bnc-decoder'
status: 'FAILED'
extra_data: '351'
**Phase 3: Completed filtering (rules).
Rule id: '1002'
Level: '2'
Description: 'Unknown problem somewhere in the system.'
**Alert to be generated.
> --
>
> ---
> You received this message because you are subscribed to the Google Groups
> "ossec-list" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to [email protected].
> For more options, visit https://groups.google.com/groups/opt_out.
>
>
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
