Hi Dan, you have right, <order> resolve my problem !! thanks!! W dniu piątek, 17 czerwca 2016 18:53:44 UTC+2 użytkownik dan (ddpbsd) napisał: > > On Fri, Jun 17, 2016 at 12:44 PM, repquota <[email protected] > <javascript:>> wrote: > > Hi guys, > > I have a trouble nn local_decoder.xml file I have something like this: > > > > <decoder name="freeradius"> > > <program_name>^freeradius</program_name> > > </decoder> > > > > <decoder name="freeradius_stop"> > > <parent>freeradius</parent> > > <prematch>^Stopping</prematch> > > <regex offset="after_prematch">^ FreeRADIUS\s(\S+)\s(\S+)</regex> > > You need an <order> here and in the following decoder. > > > </decoder> > > > > <decoder name="freeradius_start"> > > <parent>freeradius</parent> > > <prematch>^Starting</prematch> > > <regex offset="after_prematch">^ FreeRADIUS\s(\S+)\s(\S+)</regex> > > </decoder> > > > > and when I restarted ossec in logs I see : > > > > 2016/06/17 13:40:29 ossec-analysisd(2107): ERROR: Decoder configuration > > error: 'freeradius_stop'. > > 2016/06/17 13:40:29 ossec-testrule(1202): ERROR: Configuration error at > > '/etc/local_decoder.xml'. Exiting. > > > > I created this decoder for this logs: > > > > 2016 Jun 16 16:44:26 (radius) 172.16.12.135->/var/log/syslog Jun 16 > 16:44:24 > > radius freeradius[29059]: Stopping FreeRADIUS daemon: freeradius. > > 2016 Jun 16 16:44:26 (radius) 172.16.12.135->/var/log/syslog Jun 16 > 16:44:24 > > radius freeradius[29063]: Starting FreeRADIUS daemon: freeradius. > > > > Anybody has problem like this ? > > > > I checked ossec-control file and script is ok. > > > > -- > > > > --- > > You received this message because you are subscribed to the Google > Groups > > "ossec-list" group. > > To unsubscribe from this group and stop receiving emails from it, send > an > > email to [email protected] <javascript:>. > > For more options, visit https://groups.google.com/d/optout. >
-- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
