never mind, I changed the regex to:
/\[client (\d+\.\d+\.\d+\.\d+)\] ModSecurity.*Warning. Operator GT matched 3 at IP/)
now it works.
Search found 2 matches
- 25 Jun 2016, 11:52
- Forum: General Discussion (csf)
- Topic: custom rules doesn't work.
- Replies: 1
- Views: 1308
- 25 Jun 2016, 11:09
- Forum: General Discussion (csf)
- Topic: custom rules doesn't work.
- Replies: 1
- Views: 1308
custom rules doesn't work.
hello regex.custom.pm has: if (($lgfile eq $config{CUSTOM1_LOG}) and ($line =~ /ModSecurity.*Warning. Operator GT matched 3 at IP/)) { return ("mod_security wp_login triggered by",$1,"wplogin","1","80,443","1"); } if (($lgfile eq $config{CUSTOM1_LOG}...