On 01/13/2011 11:37 AM, M Haris Farooque wrote: > hi all, > > I am getting this error *Rule in /usr/local/sec/rules/snpv.cfg at line > 17: * *Invalid regular expression > '^\[\d+\]\sNEW\s(*SERVICE:\s(?|*snpv1**)\;(service1)|(**snpv**1)\;(service2)|(**snpv**)\;(service3)|(**snpv3**)\;(service4)|(**snpv**3)\;(service4)|(**snpv**4)\;(service5)|(**snpv**5)\;(service5)|(**snpv**6)\;(service6)|(**snpv**7)\;(service7))\;(SEVERE)\;(\w+)\;(\d).+$'
There is a fragment (*SERVICE:\s(?| in the regular expression, and I suspect that your actual intention was to write it as (*SERVICE:\s(?: in order to achieve grouping without setting a match variable. Perl 5.8.8 indeed thinks that (?| is a flaw, since the ? quantifier follows a special character (. However, Perl 5.10 thinks it's legal, but I am not sure what (?| would match. kind regards, risto (A minor side note -- SEC-2.6 logs more information about errors in regular expressions than 2.5.3 does.) > > * on one of my machine with following configuration; > > 1. SEC 2.5.3 > 2. SuSe Server 10 (x86_64) > 3. Perl v5.8.8 built for x86_64 > > however, on another machine with same rule sets it is not giving any > error and everything is working fine. > SuSe 11 x_64 machine > > 1. SEC 2.5.3 > 2. SuSe Server 11 (x86_64) > 3. Perl v5.10.0 built for x86_64-linux > > apart from difference in their architectural configuration, there is a > difference of Perl versions. is this the case why i am gettign this > error or else? > -- > > Kind Reagrds/Mit freundlichen Grüßen > > M Haris Farooque > > > > ------------------------------------------------------------------------------ > Protect Your Site and Customers from Malware Attacks > Learn about various malware tactics and how to avoid them. Understand > malware threats, the impact they can have on your business, and how you > can protect your company and customers by using code signing. > http://p.sf.net/sfu/oracle-sfdevnl > > > > _______________________________________________ > Simple-evcorr-users mailing list > Simple-evcorr-users@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users ------------------------------------------------------------------------------ Protect Your Site and Customers from Malware Attacks Learn about various malware tactics and how to avoid them. Understand malware threats, the impact they can have on your business, and how you can protect your company and customers by using code signing. http://p.sf.net/sfu/oracle-sfdevnl _______________________________________________ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
