[EMAIL PROTECTED] wrote: > It comes back with " Invalid regular expression " for this rule and does > not load.
Thats what I get for not testing it out before hand... Here is one that I tested against the input you sent: type=single desc=Illegal User Attempt ptype=RegExp pattern= ([A-z0-9._-]+/[A-z0-9._-]+) sshd\[[0-9]+\]: .*No account present for user for illegal user action=pipe '$0' /bin/mailx -s "***ALERT*** $1 SSH Illegal User" [EMAIL PROTECTED] -- -dave ------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2008. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ _______________________________________________ Simple-evcorr-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
