ossec-hids icon indicating copy to clipboard operation
ossec-hids copied to clipboard

* dovecot decoder fix

Open AdUser opened this issue 2 years ago • 0 comments

This patch fixes incorrect capture of "local ip" address in dovecot decoder. Example line from logs:

dovecot: imap-login: Login: user=<[email protected]>, method=PLAIN, rip=1.2.3.4, lip=4.5.6.7, mpid=8303, session=<0d/WNNoKGMjAqDr9>

Old regex captures "4.5.6.7," (extra comma at end).

AdUser avatar Nov 24 '23 02:11 AdUser