2017-03-29 18:15 GMT+03:00 James Lay <j...@slave-tothe-box.net>: > On 2017-03-28 15:09, Tom Damon wrote: > > Hi, > > I'm new to the list, so my apologies if this isn't the appropriate > place for this question. > > I'm trying to use the following rule to send an email formatted in a > particular way. Usually, '\n' works with the mail command to signal a > new line, but just comes through as '\n' as this rule is written. I've > tried several other methods with no luck, is there a proper way to do > this? > > type=single > > ptype=regexp > > pattern=.*?A user account was locked out.*?Account Name: (\S+)\$ > Account Domain: (\S+).*?Account Name: (\S+).*?Caller Computer Name: > ?(\S+)\|.* > > desc=(WARNING) reload requested for $1 > > action=pipe 'Domain Controller= $2\nUser Domain= $2\nUser Login= > $3\nLock Origin = $4\n\nOriginal Message:$0' mail -s 'User account > lockout' admin@email > > Tom Damon > > Enclose the whole thing in single quotes, and double quote the vars: > > '"$0"\n\n1\) bleah \n2\) meh' > > That is what is working for me at least.
That would not unfortunately work for the 'pipe' action, since it passes a string directly to the standard input of another process. Sec does not provide interpretation for \n, and thus receiving process will get two consecutive characters "\" and "n" instead of newline. Things would be different if "shellcmd echo -e 'some\nstring' | someprogram" action is used, since now echo will replace "\" and "n" with newline. kind regards, risto > > James > > ------------------------------------------------------------------------------ > Check out the vibrant tech community on one of the world's most > engaging tech sites, Slashdot.org! http://sdm.link/slashdot > _______________________________________________ > Simple-evcorr-users mailing list > Simple-evcorr-users@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users > ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot _______________________________________________ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
