{"action":"opened","issue":{"url":"https://api.github.com/repos/ossec/ossec-hids/issues/519","labels_url":"https://api.github.com/repos/ossec/ossec-hids/issues/519/labels{/name}","comments_url":"https://api.github.com/repos/ossec/ossec-hids/issues/519/comments","events_url":"https://api.github.com/repos/ossec/ossec-hids/issues/519/events","html_url":"https://github.com/ossec/ossec-hids/issues/519","id":56132209,"number":519,"title":"regex failing in decoder","user":{"login":"mfbiux","id":6702974,"avatar_url":"https://avatars.githubusercontent.com/u/6702974?v=3","gravatar_id":"","url":"https://api.github.com/users/mfbiux","html_url":"https://github.com/mfbiux","followers_url":"https://api.github.com/users/mfbiux/followers","following_url":"https://api.github.com/users/mfbiux/following{/other_user}","gists_url":"https://api.github.com/users/mfbiux/gists{/gist_id}","starred_url":"https://api.github.com/users/mfbiux/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mfbiux/subscriptions","organizations_url":"https://api.github.com/users/mfbiux/orgs","repos_url":"https://api.github.com/users/mfbiux/repos","events_url":"https://api.github.com/users/mfbiux/events{/privacy}","received_events_url":"https://api.github.com/users/mfbiux/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-01-31T17:33:38Z","updated_at":"2015-01-31T17:33:38Z","closed_at":null,"body":"I have the following regex in a decoder\r\n\r\n<regex>^\\d\\d\\d\\d \\w\\w\\w \\d\\d \\d\\d:\\d\\d:\\d\\d WinEvtLog: Security: (\\w+)\\((\\d+)\\): (\\.+): </regex>\r\n<regex>(\\.+): \\.+: (\\S+): </regex>\r\n<regex>(\\.+)Source</regex>\r\n\r\nand the following event\r\n\r\n2015 Jan 31 11:46:55 WinEvtLog: Security: AUDIT_FAILURE(4625): Microsoft-Windows-Security-Auditing: (no user): no domain: server: An account failed to log on. Subject:  Security ID:  S-1-5-18  Account Name:  server$  Account Domain:  WORKGROUP  Logon ID:  0x3e7  Logon Type:   10  Account For Which Logon Failed:  Security ID:  S-1-0-0  Account Name:  Administrator  Account Domain:  server  Failure Information:  Failure Reason:  %%2313  Status:   0xc000006d  Sub Status:  0xc000006a  Process Information:  Caller Process ID: 0x19d4  Caller Process Name: C:\\Windows\\System32\\winlogon.exe  Network Information:  Workstation Name: server  Source Network Address: 1.1.1.1  Source Port:  1591  Detailed Authentication Information:  Logon Process:  User32   Authentication Package: Negotiate  Transited Services: -  Package Name (NTLM only): -  Key Length:  0  This event is generated when a logon request fails. It is generated on the computer where access was attempted.\r\n\r\n\r\n\r\nEverything between the first \"server: \" and \"Source Network Address\" should be captured by the last regex tag. However, the regex not only fails, but also crashes. By removing the last tag, it works perfectly.\r\n\r\nIt looks like the system cannot used full words to stop processing the regex, like if (\\.+)Source failes because the word \"Source\" is used.\r\n\r\nIs this supposed to be the right behavior?\r\n\r\nThanks."}}