Re: Multiline in prelude-lml
"bob bob" <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <[email protected]> |
Hello.
I think you misunderstood my problem.
When I parse a multiline log, the first rule define a new context but don't
throw the alert ("silent"). Only the last rule throw the alert using "last"
keyword. This part is okay.
My problem is to tell prelude-lml to stop trying match any rule once it has
match one. At the moment, when prelude-lml match a rule (ie: the first one),
it keep trying to match the next ones. This is this behavior that I'd like
to change.
Is there a way of telling prelude "Ok, you have match a rule, then now, stop
trying to match the next ones, parse the next line"?
Thanks.
Gaël.
2008/7/7 Yoann Vandoorselaere <[email protected]>:
> Hello Gaël,
>
> Le mardi 24 juin 2008 à 11:50 +0200, bob bob a écrit :
> > Trying to parse a multiline log with prelude-lml, I've try to use the
> > context mechanism.
> > This work pretty well but my problem is that once prelude has match one
> of
> > my rule, it keeps trying to match the other rules. I'd like to know if
> there
> > is a way to tell prelude-lml to stop trying to match a rule once it has
> > match one.
> >
> > The logs I'm trying to parse are a bit tricky, that's why I must use a
> > generic rule (regex=(.+)). That's why I would like to know if there is a
> way
> > to stop prelude once it has match a rule instead of keep going trying to
> > match the other one.
>
> To summarize, once your initial context is created by the first rule,
> the second rule match, but then you can't go back to the first rule?
>
> If that is it, you probably need to destroy the created context in the
> secondary rule. Otherwise, please send a sample of your rules
> demonstrating the problem, so that we can have a direct look at it.
>
> Regards,
>
> --
> Yoann Vandoorselaere | Responsable R&D / CTO | PreludeIDS Technologies
> Tel: +33 (0)8 70 70 21 58 Fax: +33(0)4 78 42 21 58
> http://www.prelude-ids.com
>
>
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user