[ossec-cvs] ossec-hids: decoder.xml (HEAD) [dcid]

[OSSEC CVS <cvs-commit@xxxxxxxxx>]

Module name:	ossec-hids
Changes by:	dcid	07/08/15 21:24:23

Modified files:
	decoder.xml

Log message:
Description: Fixing vpopmail decoder. Patch sent by Steve West.
Reviewed by: dcid
Bug:

Index: decoder.xml
===================================================================
RCS file: /usr/cvsroot/ossec-hids/etc/decoder.xml,v
diff -u -r1.119 -r1.120
--- decoder.xml	13 Aug 2007 02:11:47 -0000	1.119
+++ decoder.xml	16 Aug 2007 00:24:22 -0000	1.120
@@ -414,6 +414,7 @@
   - vpopmail[32485]: vchkpw-pop3: password fail abc@xxxxxxx:x.x.x.x
   - vpopmail[32485]: vchkpw-2110 password fail abc@xxxxxxx:x.x.x.x
   - vpopmail[2100]: vchkpw-pop3: vpopmail user not found abc@xxxxxxx:x.x.x.x
+  - vpopmail[4162]: vchkpw-pop3: vpopmail user not found support@:69.3.64.3
   -->
 <decoder name="vpopmail">
   <program_name>^vpopmail</program_name>
@@ -429,7 +430,7 @@
 <decoder name="vpopmail-notfound">
   <parent>vpopmail</parent>
   <prematch>^vchkpw-pop3: vpopmail user not </prematch>
-  <regex offset="after_prematch">^found (\S+)@\S+:(\d+.\d+.\d+.\d+)$</regex>
+  <regex offset="after_prematch">^found (\S+)@\S*:(\d+.\d+.\d+.\d+)$</regex>
   <order>user, srcip</order>
 </decoder>