Wow - thanks Dan. Is there a link to all the variables that can be used in decoders for future reference? I find the original PDF lacking.
On Monday, July 1, 2013 11:32:08 AM UTC-4, dan (ddpbsd) wrote: > > On Mon, Jul 1, 2013 at 10:52 AM, David Blanton > <[email protected] <javascript:>> wrote: > > Ideally, I would like the decoder to just look for 'FAILED : ' > > > > could it also be like this? > > > > <decoder name="bnc"> > > <prematch>FAILED : \d+</prematch> > > > > </decoder> > > > > Both of these decoders are bad. The first one didn't have an "<order>" > after the regex, and this one is way too broad IMO. > > With the limited sample size, I've gotten this to work: > <decoder name="bnc-decoder"> > <prematch>^\d+-\d+: \S+ \d+-\d+ \d+-\d+ \S+ </prematch> > <regex offset="after_prematch">^(\S+): \S(\d+)$</regex> > <order>status, extra_data</order> > </decoder> > > 2013/07/01 11:24:32 ossec-testrule: INFO: Reading local decoder file. > 2013/07/01 11:24:32 ossec-testrule: INFO: Started (pid: 25839). > ossec-testrule: Type one log per line. > > > > **Phase 1: Completed pre-decoding. > full event: '119445-00025: P31128449pdf9030215.zip 0312-3 > 11-28449 pdf903 FAILED: -351' > hostname: 'arrakis' > program_name: '(null)' > log: '119445-00025: P31128449pdf9030215.zip 0312-3 11-28449 > pdf903 FAILED: -351' > > **Phase 2: Completed decoding. > decoder: 'bnc-decoder' > status: 'FAILED' > extra_data: '351' > > **Phase 3: Completed filtering (rules). > Rule id: '1002' > Level: '2' > Description: 'Unknown problem somewhere in the system.' > **Alert to be generated. > > > > > -- > > > > --- > > You received this message because you are subscribed to the Google > Groups > > "ossec-list" group. > > To unsubscribe from this group and stop receiving emails from it, send > an > > email to [email protected] <javascript:>. > > For more options, visit https://groups.google.com/groups/opt_out. > > > > > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
