Merge pull request #1657 from jubois/updated_decoder

Decoder rules simplification patterns occured twice ( "a|a" => "a")
ossec · Jan 31, 2019 · aeead73 · aeead73
2 parents 1da281d + e1ad337
commit aeead73
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/etc/decoder.xml b/etc/decoder.xml
@@ -601,7 +601,7 @@ Jan  8 19:32:41 tp.lan dropbear[15165]: Pubkey auth succeeded for 'root' with ke
 
 <decoder name="proftpd-ip">
   <parent>proftpd</parent>
-  <regex>^\S+ \(\S+[(\S+)]\)|^\S+ \(\S+[(\S+)]\)</regex>
+  <regex>^\S+ \(\S+[(\S+)]\)</regex>
   <order>srcip</order>
 </decoder>
 
@@ -906,7 +906,7 @@ Jan  8 19:32:41 tp.lan dropbear[15165]: Pubkey auth succeeded for 'root' with ke
 
 <decoder name="courier-generic">
   <parent>courier</parent>
-  <regex>, ip=[(\S+)]$|, ip=[(\S+)]$</regex>
+  <regex>, ip=[(\S+)]$</regex>
   <order>srcip</order>
 </decoder>