From 98fb72441df25334f4b544ab90743a04850b04ed Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Mon, 10 Mar 2008 12:52:32 -0400 Subject: [PATCH 1/2] BF: now proftpd log msgs include ip mask, failregex adjusted to absorb it as well --- config/filter.d/proftpd.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/filter.d/proftpd.conf b/config/filter.d/proftpd.conf index 52a741e8..21c8fc2e 100644 --- a/config/filter.d/proftpd.conf +++ b/config/filter.d/proftpd.conf @@ -14,7 +14,7 @@ # (?:::f{4,6}:)?(?P\S+) # Values: TEXT # -failregex = \(\S+\[\]\)[: -]+ USER \S+: no such user found from \S+ \[[0-9.]+\] to \S+:\S+$ +failregex = \(\S+\[\]\)[: -]+ USER \S+: no such user found from \S+ \[\S+\] to \S+:\S+$ \(\S+\[\]\)[: -]+ USER \S+ \(Login failed\): Incorrect password\.$ \(\S+\[\]\)[: -]+ SECURITY VIOLATION: \S+ login attempted\.$ \(\S+\[\]\)[: -]+ Maximum login attempts \(\d+\) exceeded$ From b54b7def463ba753bffe619df7356a16c2fc8deb Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Sun, 18 Jan 2009 11:43:48 -0500 Subject: [PATCH 2/2] BF: removing starting anchor from standard time pattern (closes: #500824). --- server/datedetector.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server/datedetector.py b/server/datedetector.py index c47a67c4..2a69a651 100644 --- a/server/datedetector.py +++ b/server/datedetector.py @@ -46,7 +46,7 @@ class DateDetector: # standard template = DateStrptime() template.setName("Month Day Hour:Minute:Second") - template.setRegex("^\S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}") + template.setRegex("\S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}") template.setPattern("%b %d %H:%M:%S") self.__templates.append(template) # asctime