Skip to content

* dovecot decoder fix - #2106

Merged
atomicturtle merged 1 commit into
ossec:masterfrom
AdUser:dovecot-decoder-fix
Aug 25, 2026
Merged

atomicturtle merged 1 commit into
ossec:masterfrom
AdUser:dovecot-decoder-fix

Conversation

@AdUser

@AdUser AdUser commented Nov 24, 2023

Copy link
Copy Markdown

This patch fixes incorrect capture of "local ip" address in dovecot decoder. Example line from logs:

dovecot: imap-login: Login: user=<admin@example.com>, method=PLAIN, rip=1.2.3.4, lip=4.5.6.7, mpid=8303, session=<0d/WNNoKGMjAqDr9>

Old regex captures "4.5.6.7," (extra comma at end).

@atomicturtle
atomicturtle merged commit da6f8a5 into ossec:master Aug 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants