Re: [Prelude Hybrid IDS] #283: lml nagios rule
"Prelude Hybrid IDS" <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.devel |
|---|---|
| Message-ID | <[email protected]> |
#283: lml nagios rule
-------------------------+--------------------------------------------------
Reporter: Philipp | Owner: yoann
Type: enhancement | Status: assigned
Priority: normal | Milestone: Prelude-LML 0.9.12
Component: prelude-lml | Version: 0.9
Severity: normal | Resolution:
Keywords: |
-------------------------+--------------------------------------------------
Changes (by yoann):
* status: new => assigned
* milestone: => Prelude-LML 0.9.12
Old description:
> the prelude lml nagios rule looks like this
> regex=SERVICE ALERT:
> (\w+)\;([\w\s]+)\;(CRITICAL|WARNING|OK)\;HARD\;\d\;(.+);
> a nagios (version 2) log entry can look like this
> SERVICE ALERT: app1.env2.domain.com;check_getDslProfile1i-version1
>
> so the (\w+) won't match the host
> and the ([\w\s]+) won't match the check_name
>
> i would change it to
> regex=SERVICE ALERT: ([\w\-\.]+\;(\S+);(CRITICAL|WARNING|OK)\;
>
> i am not shur if the there a white spaces allowed in the check_name ...
>
> cheers
> philipp
New description:
the prelude lml nagios rule looks like this
{{{
regex=SERVICE ALERT:
(\w+)\;([\w\s]+)\;(CRITICAL|WARNING|OK)\;HARD\;\d\;(.+);
}}}
a nagios (version 2) log entry can look like this
{{{
SERVICE ALERT: app1.env2.domain.com;check_getDslProfile1i-version1
}}}
so the (\w+) won't match the host and the ([\w\s]+) won't match the
check_name
i would change it to
{{{
regex=SERVICE ALERT: ([\w\-\.]+\;(\S+);(CRITICAL|WARNING|OK)\;
}}}
i am not shur if the there a white spaces allowed in the check_name ...
cheers
philipp
--
Ticket URL: <https://trac.prelude-ids.org/ticket/283#comment:1>
Prelude Hybrid IDS <http://www.prelude-ids.org>
The Prelude Hybrid Intrusion Detection System suite
_______________________________________________
Prelude-devel site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-devel