case sensitive match / regex rules

[Barnaby Cockcroft]

 

Maybe I’m misunderstanding something.

 

<match>ERROR</match> matches ERROR and error

<regex>^\.*ERROR\.*$</regex> matches “blah ERROR blah” and “blah error blah”

 

I’d really like to be able to match capitalized ERROR and not match lower case error – that was one (perhaps not very clever) trick the developers of this application chose to distinguish between a big and a small error.

 

Does ossec have case-insensitivity built into everything it does? Is there any way to get around this?

 

Thanks,

Barnaby

[Peter M. Abraham]

Greetings Barnaby:

By using google.com with site:ossec.net "case insensitive" it appears
<match> is indeed case insensitive; I don't know a way around this
issue.

Thank you.