On Tue, Dec 16, 2014 at 8:21 AM, Bill Price <[email protected]> wrote: > Thanks, but I already tried that also > > On Tuesday, December 16, 2014 8:20:08 AM UTC-5, dan (ddpbsd) wrote: >> >> On Mon, Dec 15, 2014 at 4:51 PM, Bill Price <[email protected]> wrote: >> > Thanks, but still no joy >> > >> > >> > On Monday, December 15, 2014 3:18:43 PM UTC-5, Bill Price wrote: >> >> >> >> >> >> I'm trying to decode the following message: >> >> >> >> Dec 11 06:27:14 snmpd[1469]: last message repeated 23 times. >> >> >> >> The pre-coding phase of ossec-logtest reports: >> >> >> >> **Phase 1: Completed pre-decoding. >> >> full event: 'Dec 11 06:27:14 snmpd[1469]: last message repeated >> >> 23 >> >> times' >> >> hostname: 'Samba' >> >> program_name: '(null)' >> >> log: 'snmpd[1469]: last message repeated 23 times' >> >> >> >> How do you handle a program name of '(null)' in the decoder? >> >> >> >> Try >> <program_name></program_name> >> >> (although it's unnecessary for this log message) >>
Maybe it's no longer possible. Not really a huge loss. >> >> Bill Price >> >> >> >> >> >> >> >> >> > -- >> > >> > --- >> > You received this message because you are subscribed to the Google >> > Groups >> > "ossec-list" group. >> > To unsubscribe from this group and stop receiving emails from it, send >> > an >> > email to [email protected]. >> > For more options, visit https://groups.google.com/d/optout. > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
