Re: Multiline in prelude-lml

Le mercredi 23 juillet 2008 à 08:40 +0200, bob bob a écrit :
> I think you misunderstood my problem.
> 
> When I parse a multiline log, the first rule define a new context but don't
> throw the alert ("silent"). Only the last rule throw the alert using "last"
> keyword. This part is okay.
> My problem is to tell prelude-lml to stop trying match any rule once it has
> match one. At the moment, when prelude-lml match a rule (ie: the first one),
> it keep trying to match the next ones. This is this behavior that I'd like
> to change.
> 
> Is there a way of telling prelude "Ok, you have match a rule, then now, stop
> trying to match the next ones, parse the next line"?

My previous answer seems appropriate:

regex=FirstRule; \
create_context=FIRST_RULE_MATCHED; \
silent;

regex=SecondRule; \
require_context=FIRST_RULE_MATCHED; \
destroy_context=FIRST_RULE_MATCHED; \
last;

Using the above, SecondRule won't match until FirstRule is matched and
create the "FIRST_RULE_MATCHED" context. 

When SecondRule match, the "FIRST_RULE_MATCHED" context is destroyed,
and you are back to the initial state (FirstRule need to match before
SecondRule can be activated).

Isn't that what you are trying to achieve?
By the way, what product are you trying to write a ruleset for?

Regards,

-- 
Yoann Vandoorselaere | Responsable R&D / CTO | PreludeIDS Technologies
Tel: +33 (0)8 70 70 21 58                  Fax: +33(0)4 78 42 21 58
http://www.prelude-ids.com

_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user