hi Tom,
backslash sequences are not interpreted in sec actions, but you can
use builtin action list variables instead. In order to insert the
newline character into the 'pipe' action string, use the %{.nl} action
list variable. You can also refer to it as %.nl, but since in your
case letters would be following the variable name, curly braces are
necessary for disambiguation.
Should you need other special characters in your action lists, the
complete list of all builtin action list variables is provided in the
"Actions, Action Lists and Actoin List Variables" section of the
official documentation: http://simple-evcorr.github.io/man.html#lbAI
hope this helps,
risto
2017-03-29 0:09 GMT+03:00 Tom Damon <t...@logzilla.net>:
> Hi,
>
> I’m new to the list, so my apologies if this isn’t the appropriate place
> for this question.
>
> I’m trying to use the following rule to send an email formatted in a
> particular way. Usually, ‘\n’ works with the mail command to signal a new
> line, but just comes through as ‘\n’ as this rule is written. I’ve tried
> several other methods with no luck, is there a proper way to do this?
>
>
>
> type=single
>
> ptype=regexp
>
> pattern=.*?A user account was locked out.*?Account Name: (\S+)\$ Account
> Domain: (\S+).*?Account Name: (\S+).*?Caller Computer Name: ?(\S+)\|.*
>
> desc=(WARNING) reload requested for $1
>
> action=pipe 'Domain Controller= $2\nUser Domain= $2\nUser Login= $3\nLock
> Origin = $4\n\nOriginal Message:$0' mail -s 'User account lockout'
> admin@email
>
>
>
> Tom Damon
>
> LogZilla
>
>
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> _______________________________________________
> Simple-evcorr-users mailing list
> Simple-evcorr-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
>
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
Simple-evcorr-users mailing list
Simple-evcorr-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
