[ossec-dev] XML Rule files not according to XML specification.

[Frank Spierings <Frank.Spierings@xxxxxxxxx>]

I was trying to implement a nice PHP based rule editor. I'm stuck at
the moment though, since I would love to use SimpleXML for parsing the
XML rule files back and forth. Problem is, that not all the rule files
are according to the XML specification, since some rule files have
multiple root elements.
I was wondering if I could give these files an encapsulating element
like for instance -->
<document>
  <group></group>
  <group></group>
  <group></group>
</document>
Without modifying the ossec source code (probably not...). And
otherwise I look for a hint where I should find the code which
currently handles it.

Also I noticed that for instance ids_rules.xml contains an
undocumented <var> element. This is not helping my "project" either ;)

Hope somebody can help,

Thanks in advance,

Frank Spierings