Santiago,
After testing variations of your log edits, I'm finding that keeping the
pid in place and just adding the port produces:
**Phase 2: Completed decoding.
decoder: 'apache-errorlog'
srcip: '46.4.84.147'
id: 'ModSecurity'
How can I get the decoder to not require the port or get the port to append
to the IP?
Brian
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
