Multiline in prelude-lml
"bob bob" <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <[email protected]> |
Hi, Trying to parse a multiline log with prelude-lml, I've try to use the context mechanism. This work pretty well but my problem is that once prelude has match one of my rule, it keeps trying to match the other rules. I'd like to know if there is a way to tell prelude-lml to stop trying to match a rule once it has match one. The logs I'm trying to parse are a bit tricky, that's why I must use a generic rule (regex=(.+)). That's why I would like to know if there is a way to stop prelude once it has match a rule instead of keep going trying to match the other one. Excuse my english and thanks. Gaël. _______________________________________________ Prelude-user site list [email protected] http://lists.prelude-ids.org/mailman/listinfo/prelude-user