ossec-hids
ossec-hids copied to clipboard
* dovecot decoder fix
This patch fixes incorrect capture of "local ip" address in dovecot decoder. Example line from logs:
dovecot: imap-login: Login: user=<[email protected]>, method=PLAIN, rip=1.2.3.4, lip=4.5.6.7, mpid=8303, session=<0d/WNNoKGMjAqDr9>
Old regex captures "4.5.6.7," (extra comma at end).