[ossec-dev] [Bug 85] decoder.xml - incorrect cisco regular expressions

[ossec-bugzilla@xxxxxxxxxxxxxxxxxxxxxxxxxxx]

http://www.ossec.net/bugs/show_bug.cgi?id=85





------- Comment #3 from t@xxxxxxxx  2007-10-07 12:23 -------
I knew I should have documented notes on this; I had to look it up again.

Samples are listed at
http://cisco.com/en/US/products/ps6350/products_command_reference_chapter09186a0080444bd0.html#wp1032686. 

The \p was to match a possible * or ., signifying an unauthoritative or
unsynchronized clock. Ideally, I would have used a tighter regex, but os_regex
didn't appear to let me specify specify a subset of characters. "\*:" is under
the assumption that the regular expression isn't greedy and will match only up
to the first colon (:). I was using it to match on the potential existence of
milliseconds.

Trey


-- 
Configure bugmail: http://www.ossec.net/bugs/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.