X-Git-Url: http://ftp.carnet.hr/carnet-debian/scm?a=blobdiff_plain;ds=sidebyside;f=contrib%2Flogtesting%2F37%2Fres;fp=contrib%2Flogtesting%2F37%2Fres;h=61c466e5eb255fd53e689eeb6bdc0c42347d5e8e;hb=ff0e686ac67bbd82b60c277eb324910dbc60f65f;hp=0000000000000000000000000000000000000000;hpb=33a81e69474ae91ecec4e991debe59e26bb330fd;p=ossec-hids.git

diff --git a/contrib/logtesting/37/res b/contrib/logtesting/37/res
new file mode 100644
index 0000000..61c466e
--- /dev/null
+++ b/contrib/logtesting/37/res
@@ -0,0 +1,17 @@
+**Phase 1: Completed pre-decoding.
+       full event: 'Apr 17 22:20:29 hostj named[312]: [ID 295310 daemon.notice] security: notice: dropping source port zero packet from [64.211.251.254].0'
+       hostname: 'hostj'
+       program_name: 'named'
+       log: 'security: notice: dropping source port zero packet from [64.211.251.254].0'
+
+**Phase 2: Completed decoding.
+       decoder: 'named'
+       srcip: '64.211.251.254'
+
+**Phase 3: Completed filtering (rules).
+       Rule id: '12101'
+       Level: '12'
+       Description: 'Invalid DNS packet. Possibility of attack.'
+**Alert to be generated.
+
+