Re: Problem handling a new sensor with prelude-lml

Hey Scott,

Thanks a lot for the quick response! You were totally right about the
regex in pcre.rules.. The regex was originally there when I used to tag
my syslog messages with "openvasd", but now that I've added another log
format, I'm not using this tag anymore. Finally I've made a simple fix
to that regex and everything is working as expected!!

Thanks a ton for that! and for the tip about easy bindings. As an
exercice, I'll try to code a sensor in python for OpenVAS. If anyone is
interested, it'll be a pleasure for me to share my work.

P.

> I don't really do much with adding in non-syslog files for watching
> with LML, however, the regex you specified pcre.rules doesn't match
> the sample log line you provided - so in the very least rules in
> openvasd.rules will not be applied to it.  The regex in pcre.rules is
> used to find something that will be in all your log messages and is
> used to limit the number of LML rules that get applied to each log
> message LML sees.
>
> On a different note, depending on how comfortable you are with
> something like Perl or Python, the Prelude Easy Bindings would easily
> allow you to craft your own agent and get the data however you wanted
> into Prelude.  The Easy Bindings are fantastic and have made my life
> alot easier, :). 
>
> See here for more easy bindings examples:
>
> https://dev.prelude-technologies.com/wiki/prelude/DevelAgentBuilding#Using-Python
>
> Scott

_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-technologies.com/mailman/listinfo/prelude-user

begin:vcard
fn:Philippe Blondin
n:Blondin;Philippe
org:Gardien Virtuel inc.
email;internet:[email protected]
title;quoted-printable:Analyste en s=C3=A9curit=C3=A9 TI
x-mozilla-html:FALSE
version:2.1
end:vcard