On 08/04/2013 12:19 PM, Jared wrote:
Would someone be so kind as to tell me what I am missing here?
Raw log line:
[2013-08-03 23:45:24,461] javax.mail.AuthenticationFailedException
tab-bracket-yyyy-dash-mm-dd-space-hh-colon-mm-colon-ss-comma(punctuation)-nnn-bracket
someRandomText
Decoder:
<decoder name="MailFailRLB">
<prematch>^\t[\d\d\d\d-\d\d-\d\d \d\d:\d\d:\d\d,\d\d\d] \w+
javax.mail.AuthenticationFailedException</prematch>
</decoder>
Is missing something.
Try this:
<decoder name="MailFailRLB">
<prematch>^[\d\d\d\d-\d\d-\d\d \d\d:\d\d:\d\d,\d\d\d]
javax.mail.AuthenticationFailedException</prematch>
</decoder>
There were two problems:
1. No tab at the beginning of the log line
2. no \w+ prior to javax.mail.AuthenticationFailedException
--
---
You received this message because you are subscribed to the Google Groups "ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
