From 75f5c7e00fc8d99cd15d5b34f76c36ec8690b4af Mon Sep 17 00:00:00 2001
From: tokibi <tatu014@gmail.com>
Date: Tue, 18 Dec 2018 12:02:05 +0900
Subject: [PATCH] Fix uid regex

---
 decoders/0040-auditd_decoders.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/decoders/0040-auditd_decoders.xml b/decoders/0040-auditd_decoders.xml
index 691034aa2..715319968 100644
--- a/decoders/0040-auditd_decoders.xml
+++ b/decoders/0040-auditd_decoders.xml
@@ -250,7 +250,7 @@ type=TEST_GENERIC msg=audit(1234567890.123:1234): addr=10.10.10.10 ses=20 exe="l
 
 <decoder name="auditd-generic">
     <parent>auditd</parent>
-    <regex>uid=(\S+)</regex>
+    <regex> uid=(\S+)</regex>
     <order>audit.uid</order>
 </decoder>