Re: Multiline in prelude-lml

Hello Gaël,

Le mardi 24 juin 2008 à 11:50 +0200, bob bob a écrit :
> Trying to parse a multiline log with prelude-lml, I've try to use the
> context mechanism.
> This work pretty well but my problem is that once prelude has match one of
> my rule, it keeps trying to match the other rules. I'd like to know if there
> is a way to tell prelude-lml to stop trying to match a rule once it has
> match one.
> 
> The logs I'm trying to parse are a bit tricky, that's why I must use a
> generic rule (regex=(.+)). That's why I would like to know if there is a way
> to stop prelude once it has match a rule instead of keep going trying to
> match the other one.

To summarize, once your initial context is created by the first rule,
the second rule match, but then you can't go back to the first rule? 

If that is it, you probably need to destroy the created context in the
secondary rule. Otherwise, please send a sample of your rules
demonstrating the problem, so that we can have a direct look at it.

Regards,

-- 
Yoann Vandoorselaere | Responsable R&D / CTO | PreludeIDS Technologies
Tel: +33 (0)8 70 70 21 58                  Fax: +33(0)4 78 42 21 58
http://www.prelude-ids.com

_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user