Hi Luan, Pre-decoders are hardcoded in OSSEC code, to modify or add a new predecoder you have to write it directly on C code <https://github.com/wazuh/ossec-wazuh/blob/master/src/analysisd/cleanevent.c>, check for example the syslog pre-decoder. <https://github.com/wazuh/ossec-wazuh/blob/master/src/analysisd/cleanevent.c#L77>
Regards, Pedro S. On Sunday, February 28, 2016 at 2:43:09 PM UTC+1, luan vo wrote: > > Hello everyone , I began to learn OSSEC . Can tell me *pre - decod*e > stage can tweak it? thank for all > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
