Re: [Prelude Hybrid IDS] #307: Additional prefix-regex to deal with apache error_log file format

#307: Additional prefix-regex to deal with apache error_log file format
-------------------------+--------------------------------------------------
 Reporter:  Shurcik      |        Owner:  yoann             
     Type:  enhancement  |       Status:  assigned          
 Priority:  normal       |    Milestone:  Prelude-LML 0.9.13
Component:  prelude-lml  |      Version:  0.9               
 Severity:  normal       |   Resolution:                    
 Keywords:  apache       |  
-------------------------+--------------------------------------------------
Changes (by yoann):

  * owner:  => yoann
  * status:  new => assigned


Old description:

> Current prelude-lml configuration has httpd.rules that deal with errors
> in apache logs but [format=apache] section in prelude-lml.conf deals with
> only common log format, not error log format. So nobody is able to parse
> errors since prelude-lml.conf doesn't match them. Here're the additions
> to prelude-lml.conf (I added additional blank lines, so remove them):
>
> [format=apache-error]
>
> time-format = "%a %b %d %H:%M:%S %Y"
>
> prefix-regex = "^\[(?P<timestamp>.{24})\] \S+ \[client
> (?P<hostname>\S+)\] "
>
> file = /var/log/httpd/error_log

New description:

 Current prelude-lml configuration has httpd.rules that deal with errors in
 apache logs but [format=apache] section in prelude-lml.conf deals with
 only common log format, not error log format. So nobody is able to parse
 errors since prelude-lml.conf doesn't match them. Here're the additions to
 prelude-lml.conf (I added additional blank lines, so remove them):

 {{{
 [format=apache-error]
 time-format = "%a %b %d %H:%M:%S %Y"
 prefix-regex = "^\[(?P<timestamp>.{24})\] \S+ \[client (?P<hostname>\S+)\]
 "
 file = /var/log/httpd/error_log
 }}}

--

-- 
Ticket URL: <https://trac.prelude-ids.org/ticket/307#comment:1>
Prelude Hybrid IDS <http://www.prelude-ids.org>
The Prelude Hybrid Intrusion Detection System suite
_______________________________________________
Prelude-devel site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-devel