From 5165d2f6ea19a7781902b1ca7c32ca2f6f0238d1 Mon Sep 17 00:00:00 2001 From: JoelSnyder Date: Mon, 9 Jun 2014 18:44:27 -0700 Subject: [PATCH] Update oracleims.conf to be 'less greedy' This assumes that the protocol is always a string, which it always is, and that the other four fields in the "tr" are always numeric (which they always are). See port_access documentation at http://docs.oracle.com/cd/E19563-01/819-4428/bgaur/index.html --- config/filter.d/oracleims.conf | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/config/filter.d/oracleims.conf b/config/filter.d/oracleims.conf index e80d0b96..083702ce 100644 --- a/config/filter.d/oracleims.conf +++ b/config/filter.d/oracleims.conf @@ -45,12 +45,14 @@ before = common.conf # mi="Bad password" # us="01ko8hqnoif09qx0np@imap.opus1.com" # di="535 5.7.8 Bad username or password (Authentication failed)."/> +# Format is generally documented in the PORT_ACCESS mapping +# at http://docs.oracle.com/cd/E19563-01/819-4428/bgaur/index.html # # All that would be on one line. # Note that you MUST have LOG_FORMAT=4 for this to work! # -failregex = ^.*tr=".*\|.*\|\d+\|\|\d+" .+ Bad username or password.*"/>$ +failregex = ^.*tr="[A-Z]+\|[0-9.]+\|\d+\|\|\d+" .+ Bad username or password.*"/>$ # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored.