Merge pull request #246 from tokibi/fix_auditd_decoders

Fix auditd decoders
wazuh · Jun 14, 2019 · 278025a · 278025a
2 parents b5521e6 + 75f5c7e
commit 278025a
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/decoders/0040-auditd_decoders.xml b/decoders/0040-auditd_decoders.xml
@@ -300,7 +300,7 @@ type=TEST_GENERIC msg=audit(1234567890.123:1234): addr=10.10.10.10 ses=20 exe="l
 
 <decoder name="auditd-generic">
  <parent>auditd</parent>
- <regex>uid=(\S+)</regex>
+ <regex> uid=(\S+)</regex>
  <order>audit.uid</order>
 </decoder>