Project

General

Profile

Feature #307

Additional prefix-regex to deal with apache error_log file format

Added by almost 14 years ago. Updated over 13 years ago.

Status:
Closed
Priority:
Normal
Target version:
Start date:
Due date:
% Done:

0%

Resolution:
fixed

Description

Current prelude-lml configuration has httpd.rules that deal with errors in apache logs but [format=apache] section in prelude-lml.conf deals with only common log format, not error log format. So nobody is able to parse errors since prelude-lml.conf doesn't match them. Here're the additions to prelude-lml.conf (I added additional blank lines, so remove them):

[format=apache-error]
time-format = "%a %b %d %H:%M:%S %Y" 
prefix-regex = "^\[(?P<timestamp>.{24})\] \S+ \[client (?P<hostname>\S+)\] " 
file = /var/log/httpd/error_log

History

#1 Updated by Yoann VANDOORSELAERE almost 14 years ago

  • Status changed from New to Assigned

#2 Updated by Yoann VANDOORSELAERE almost 14 years ago

  • Status changed from Assigned to Closed
  • Resolution set to fixed

Fixed in r10887.

#3 Updated by Yoann VANDOORSELAERE over 13 years ago

  • Project changed from PRELUDE SIEM to Prelude-LML
  • Category deleted (4)
  • Target version deleted (0.9.13)

Also available in: Atom PDF