[ossec-list] Customized Decoder

[Eric B. Biondi]

Hi

I've created two decoders and one is working correctly, but the second
isn't.

I can't see where my error is. Can anyone help?

Both work off the same parent, so the parent should be fine. Perhaps the
slashes are throwing me off?


<!--
2010-04-27 10:28:01,914 WARN
[btpool0-1590://localhost/service/soap/AuthRequest]
[name=er...@mydomain.com;oip=1.2.3.4;ua=zclient/6.0.5_GA_2213.UBUNTU8_64;]
security - cmd=Auth; account=er...@mydomain.com; protocol=soap;
error=authentication failed for er...@mydomain.com, account lockout;
-->

<decoder name="zimbra-audit2">
<parent>zimbra</parent>
<regex offset="after_parent">[\S+]
[name=\S+;oip=(\d+.\d+.\d+.\d+);\S+;]</regex>
<order>srcip</order>
</decoder>





--
Subscription settings: http://groups.google.com/group/ossec-list/subscribe?hl=en

[dan (ddp)]

I can't test this at the moment, so be gentle. ;)
Is oip= always an IP? If so, you could cut out a lot of the complexity
by doing something like:
<regex>oip=(\d+.\d+.\d+.\d+);</regex>
If that works, you can then build up anything else you want around
it. Get the important stuff working, and make the regex more specific
afterwards.
Also, the order of the decoders is important. I've gotten things to
work before by moving them around a bit.

[Dave S]

Hi Eric,
First off, your entire regex is enclosed in square brackets which is
incorrect.
I'd try simplifying the regular expression to something like

<regex offset="after_parent">oip=(\d+.\d+.\d+.\d+);</regex>

Try that,
Dave

[Eric Biondi]

Thank you very much Dave and Dan!

I guess I was trying too hard. LOL Everything is working great with ossec.

Thanks so much to everyone involved with this project. I LOVE this
program!!!

*************

*************

[--[ UxBoD ]--]

----- Original Message -----
> Hi
>
> I've created two decoders and one is working correctly, but the second
> isn't.
>
> I can't see where my error is. Can anyone help?
>
> Both work off the same parent, so the parent should be fine. Perhaps
> the slashes are throwing me off?
>
>
> <!--
> 2010-04-27 10:28:01,914 WARN
> [btpool0-1590://localhost/service/soap/AuthRequest]
> [name=er...@mydomain.com;oip=1.2.3.4;ua=zclient/6.0.5_GA_2213.UBUNTU8_64;]
> security - cmd=Auth; account=er...@mydomain.com; protocol=soap;
> error=authentication failed for er...@mydomain.com, account lockout;
> -->
>
> <decoder name="zimbra-audit2">
> <parent>zimbra</parent> <regex offset="after_parent">[\S+]
> [name=\S+;oip=(\d+.\d+.\d+.\d+);\S+;]</regex> <order>srcip</order>
> </decoder>
>

Eric,

what are you specifically trying to trap from Zimbra ? I may be able to share some of my rules if you would like.
--
Thanks, Phil (uxbod - Zimbra moderator)