Re: [ossec-list] Re: day of decoder problems

2012-02-02 Thread dan (ddp)
On Thu, Feb 2, 2012 at 9:42 AM, Kat wrote: > I always wondered about that - shouldn't anything in "Local..." get > processed before the built-in? > I did have a feeling it was order dependent, and I took the route of > making the rules "decoded_as - windows_date_format" and everything > works, and

[ossec-list] Re: day of decoder problems

2012-02-02 Thread Kat
I always wondered about that - shouldn't anything in "Local..." get processed before the built-in? I did have a feeling it was order dependent, and I took the route of making the rules "decoded_as - windows_date_format" and everything works, and this now confirms my thoughts that local did NOT get