On Mon, Dec 15, 2014 at 4:51 PM, Bill Price <[email protected]> wrote: > Thanks, but still no joy > > > On Monday, December 15, 2014 3:18:43 PM UTC-5, Bill Price wrote: >> >> >> I'm trying to decode the following message: >> >> Dec 11 06:27:14 snmpd[1469]: last message repeated 23 times. >> >> The pre-coding phase of ossec-logtest reports: >> >> **Phase 1: Completed pre-decoding. >> full event: 'Dec 11 06:27:14 snmpd[1469]: last message repeated 23 >> times' >> hostname: 'Samba' >> program_name: '(null)' >> log: 'snmpd[1469]: last message repeated 23 times' >> >> How do you handle a program name of '(null)' in the decoder? >>
Try <program_name></program_name> (although it's unnecessary for this log message) >> Bill Price >> >> >> >> > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
