Problem is consistently appearing. The rule that is causing the problem is written by me but I've also tested it with a wu-ftpd rule which causes the same problem.

Sensors is LML 0.9.7. I have just updated the system to 0.9.8.1. Rule is alerting on [[OpenVPN]] logins. Source info from dbadmin print below

analyzer(2):
name: [[OpenVPN]]
manufacturer: [[OpenVPN]]
class: Remote Login
node:
category: unknown (0)
name: host.name
address(0):
category: ipv4-addr (7)
address: 172.16.10.241
process:
name: openvpn
pid: 18983
create_time: 10/01/2007 08:33:52.245259 +13:00
classification:
text: Remote user logged in
detect_time: 10/01/2007 08:33:52.0 +13:00
analyzer_time: 10/01/2007 08:33:52.245313 +13:00
source(0):
spoofed: unknown (0)
node:
category: unknown (0)
address(0):
category: ipv4-addr (7)
address: 1.1.1.1
user:
category: os-device (2)
user_id(0):
type: current-user (1)
name: User_Name

In order to reproduce your problem, please provide the rule as well as the log entry used to trigger the problem.

Additional note: please format your data (see [[WikiFormatting]]) when adding ticket comment.

#LOG:openvpnr19067: 210.246.24.124:1194 [User_Name] Peer Connection Initiated with 210.246.24.124:1194
regex=\[(\w+)\] Peer Connection Initiated with ([\d\.]+); \
 classification.text=Remote user logged in; \
 id=31000; \
 revision=1; \
 analyzer(0).name=OpenVPN; \
 analyzer(0).manufacturer=OpenVPN; \
 analyzer(0).class=Remote Login; \
 source(0).user.category=os-device; \
 source(0).user.user_id(0).type=current-user; \
 source(0).user.user_id(0).name=$1; \
 source(0).node.address(0).category=ipv4-addr; \
 source(0).node.address(0).address=$2; \
 assessment.impact.severity=info; \
 assessment.impact.type=other; \
 assessment.impact.completion=succeeded; \
 assessment.impact.description=$1 has logged in; \
 last