Thank you for your response. The decoder you posted works perfectly. In the prematch you included a second option which isn't necessary in my case (but there might be logs were it is needed).
Here are two full log entries to use in tests (I changed our domain, but that should make no difference): Apr 18 09:31:42 vs postfix/postscreen[13433]: NOQUEUE: reject: RCPT from [59.37.23.174]:9011: 550 5.7.1 Service unavailable; client [59.37.23.174] blocked using b.barracudacentral.org; from=<l...@ourdomain.com>, to=<xiaonanzi11...@163.com>, proto=ESMTP, helo=<XL-20160217NGID> Apr 16 22:52:04 vs postfix/postscreen[20897]: NOQUEUE: reject: RCPT from [208.100.26.230]:43746: 550 5.7.1 Service unavailable; client [208.100.26.230] blocked using zen.spamhaus.org; from=<antis...@ourdomain.com>, to=<relayt...@nmap.scanme.org>, proto=ESMTP, helo=<nmap.scanme.org> So again, thank you, and of course a PR it would be nice. Another question: For similar questions would it be better to directly create an issue or (if I have a solution) an pull request on github, or should I first write here to see if there are better solutions? -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
