Skip to content

Instantly share code, notes, and snippets.

@DazWorrall

DazWorrall/local_decoder.xml

Created August 13, 2014 15:00
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save DazWorrall/46f0c4bc7837c6da1140 to your computer and use it in GitHub Desktop.
Save DazWorrall/46f0c4bc7837c6da1140 to your computer and use it in GitHub Desktop.
Download ZIP
OSSEC decoder for the apache vhost_combined_plus log format (debianism?)
Raw
local_decoder.xml
<decoder name="vhost-accesslog">
<type>web-log</type>
<prematch>^\S+:\d+ </prematch>
<regex offset="after_prematch">(\d+.\d+.\d+.\d+) \S+ \S+ [\S+ \S\d+] </regex>
<regex>"\w+ (\S+) HTTP\S+ (\d+) </regex>
<order>srcip, url, id</order>
</decoder>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment