Prelude-lml sensor

Hi all,

 

I'm trying to configure prelude-lml sensor but I'm wondering what's the
meaning of prefix-regex into the prelude-lml.conf file.

I thought that prefix-regex was used to match the first part of the log
trail and then the trails not-filtered by this regex were redirected to
the specific *.rules under ruleset/.

But prefix-regex doesn't filter anything.... So I cannot imagine what's
its purpose.

Let me show an example to explain my doubt.

 

 

/var/log/apache2/error_log

[Wed Mar 25 11:27:05 2009] [error] [client 192.168.80.105] File does not
exist: /usr/htdocs

 

 

/etc/prelude-lml/prelude-lml.conf

[format=apache]

time-format = "%d/%b/%Y:%H:%M:%S"

prefix-regex = "^(?P<hostname>\S+) \S+ \S+ \[(?P<timestamp>.{20})
[+-].{4}\] "

file = /var/log/apache2/error_log

. 

.

.

[Pcre=apache]

Ruleset=/etc/prelude-lml/ruleset/httpd.rules

 

 

/etc/prelude-lml/plugin.rules

# source                        plugin          pcre-options    regex

/var/log/apache2/error_log      Pcre[apache]    -               *

 

I thought that with this configuration all the trails in error_log were
discarded because the prefix-regex doesn't match but I can see the
events in the prewikka webinterface. 

It works even if I set the error_log file under format=syslog into the
prelude-lml.conf

On the other hand, the log format matches the ruleset/httpd.rules .... 

So is the filtering only made by the *.rules files? 

What's the purpose of prefix-regex and time-format into the
prelude-lml.conf?

 

Thanks 

 

---

Matteo Michelini

Security Competence Center

Lutech - http://www.lutech.it

Cologno Monzese (MI)

Via W.A.Mozart, 47 - 20093

 

_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user