[Prelude Hybrid IDS] #283: lml nagios rule

#283: lml nagios rule
-------------------------+--------------------------------------------------
 Reporter:  Philipp      |       Owner:  yoann
     Type:  enhancement  |      Status:  new  
 Priority:  normal       |   Milestone:       
Component:  prelude-lml  |     Version:  0.9  
 Severity:  normal       |    Keywords:       
-------------------------+--------------------------------------------------
 the prelude lml nagios rule looks like this
 regex=SERVICE ALERT:
 (\w+)\;([\w\s]+)\;(CRITICAL|WARNING|OK)\;HARD\;\d\;(.+);
 a nagios (version 2) log entry can look like this
 SERVICE ALERT: app1.env2.domain.com;check_getDslProfile1i-version1

 so the (\w+) won't match the host
 and the ([\w\s]+) won't match the check_name

 i would change it to
 regex=SERVICE ALERT: ([\w\-\.]+\;(\S+);(CRITICAL|WARNING|OK)\;

 i am not shur if the there a white spaces allowed in the check_name ...

 cheers
 philipp

-- 
Ticket URL: <https://trac.prelude-ids.org/ticket/283>
Prelude Hybrid IDS <http://www.prelude-ids.org>
The Prelude Hybrid Intrusion Detection System suite
_______________________________________________
Prelude-devel site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-devel