Merge pull request #1936 from ddpbsd/1927

Fix for change in named query log format
ossec · Jun 1, 2021 · 184e55e · 184e55e
2 parents 76ac7f0 + 7375fe4
commit 184e55e
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/etc/decoder.xml b/etc/decoder.xml
@@ -1007,8 +1007,8 @@ Jan  8 19:32:41 tp.lan dropbear[15165]: Pubkey auth succeeded for 'root' with ke
 
 <decoder name="named-query">
   <parent>named</parent>
-  <prematch_pcre2>: query </prematch_pcre2>
-  <pcre2>client (\S+)#\d+[ ]*?\S*: </pcre2>
+  <prematch_pcre2>: query:? </prematch_pcre2>
+  <pcre2>client @\S+ (\S+)#\d+[ ]*?\S*: </pcre2>
   <order>srcip,url</order>
 </decoder>