Thanks, but I already tried that also On Tuesday, December 16, 2014 8:20:08 AM UTC-5, dan (ddpbsd) wrote: > > On Mon, Dec 15, 2014 at 4:51 PM, Bill Price <[email protected] > <javascript:>> wrote: > > Thanks, but still no joy > > > > > > On Monday, December 15, 2014 3:18:43 PM UTC-5, Bill Price wrote: > >> > >> > >> I'm trying to decode the following message: > >> > >> Dec 11 06:27:14 snmpd[1469]: last message repeated 23 times. > >> > >> The pre-coding phase of ossec-logtest reports: > >> > >> **Phase 1: Completed pre-decoding. > >> full event: 'Dec 11 06:27:14 snmpd[1469]: last message repeated > 23 > >> times' > >> hostname: 'Samba' > >> program_name: '(null)' > >> log: 'snmpd[1469]: last message repeated 23 times' > >> > >> How do you handle a program name of '(null)' in the decoder? > >> > > Try > <program_name></program_name> > > (although it's unnecessary for this log message) > > >> Bill Price > >> > >> > >> > >> > > -- > > > > --- > > You received this message because you are subscribed to the Google > Groups > > "ossec-list" group. > > To unsubscribe from this group and stop receiving emails from it, send > an > > email to [email protected] <javascript:>. > > For more options, visit https://groups.google.com/d/optout. >
-- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
