HI All, Please help me how to extract the security fields in this message using regex or any other methods
Here is a Sample log from Snare 2012-11-30T02:41:46+08:00 CX-CDOWKSMIS003.ph.gbsorg.net MSWinEventLog 0 Security 491 Fri Nov 30 02:41:44 2012 4689 Microsoft-Windows-Security-Auditing PH\CX-CDOWKSMIS003$ N/A Success Audit CX-CDOWKSMIS003.ph.gbsorg.net Process Termination A process has exited. Subject: Security ID: S-1-5-18 Account Name: CX-CDOWKSMIS003$ Account Domain: PH Logon ID: 0x3e7 Process Information: Process ID: 0x1d50 Process Name: C:\Windows\System32\SearchFilterHost.exe Exit Status: 0x0 265 I have tried some process but to no avail. I have use the Snare parser in php logcon but it is not working. I dont have the pmsnare module as i did not compile my rsyslog installation from source. Im still new to rsyslog and regex. Thanks -- View this message in context: http://rsyslog-rsyslog-users.1305293.n2.nabble.com/Please-help-with-Snare-Format-tp7579234.html Sent from the rsyslog -- rsyslog-users mailing list archive at Nabble.com. _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
