Fix postfix decoder: Avoid non-IP content into srcip

wazuh · Feb 14, 2017 · 3d719dd · 3d719dd
1 parent 0fdd51c
commit 3d719dd
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/decoders/0220-postfix_decoders.xml b/decoders/0220-postfix_decoders.xml
@@ -15,6 +15,7 @@
     to=<e10445@jubiipost.dk> proto=SMTP helo=<SM01.net>
   - postfix/smtpd[472]: warning: 199.249.24.179.list.dsbl.org: RBL lookup error: Host or domain name not found. Name service error for name=199.249.24.179.list.dsbl.org type=A: Host not found, try again
   - postfix/smtpd[5268]: warning: 89.248.162.178: hostname no-reverse-dns-configured.com verification failed: Name or service not known
+  - postfix/master[1741]: warning: process /usr/libexec/postfix/cleanup pid 27541 exit status 1
   - postfix/smtpd[32655]: warning: Illegal address syntax from unknown[157.122.148.252] in MAIL command: <adgjlo@78.41.116.116>
   - postfix/smtpd[32655]: too many errors after RCPT from unknown[157.122.148.252]
   - May  8 08:26:55 mail postfix/smtpd[27712]: NOQUEUE: reject: MAIL from localhost[127.0.0.1]: 452 Insufficient system storage
@@ -44,6 +45,6 @@
   <use_own_name>true</use_own_name>
   <parent>postfix</parent>
   <prematch>^warning:</prematch>
-  <regex>^warning: (\S+)|warning: Illegal address syntax from unknown[(\S+)]</regex>
+  <regex>^warning: (\S+):|warning: Illegal address syntax from unknown[(\S+)]</regex>
   <order>srcip</order>
 </decoder>