Re: Discussion on ticket #307

Hi Alexander,

Le mercredi 20 août 2008 à 12:25 +0300, Alexander Afonyashin a écrit :
> I was asked at #prelude to deal with error log format of Apache, so
> I've created new [apache-error] section with new prefix-regex. It
> matches against events described in httpd.rules (eventid=4100). But
> later the same person asked me to update rules to deal with events
> like:
> 
> [Fri Dec  6 13:40:08 2002] [notice] child pid 32537 exit signal Segmentation fault (11)
> 
> This event format differs from regex I've introduced since no hostname
> is given (because it's the host where httpd is running) and pid
> exists. So the question is:
> - do we need separate [apache-segfault] section with separate regex or
> we may deal with these events in [apache-error] section?

We can deal with it directly from the [apache-error] section. No problem
with this, since it's really part of the same log format.

Regards,

-- 
Yoann Vandoorselaere | Responsable R&D / CTO | PreludeIDS Technologies
Tel: +33 (0)8 70 70 21 58                  Fax: +33(0)4 78 42 21 58
http://www.prelude-ids.com

_______________________________________________
Prelude-devel site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-devel