new upstream release (3.3.0); modify package compatibility for Stretch
[ossec-hids.git] / contrib / logtesting / 31 / res
index 597abea..9ad2d73 100644 (file)
@@ -6,6 +6,10 @@
 
 **Phase 2: Completed decoding.
        decoder: 'sudo'
+       dstuser: 'dcid'
+       url: '/var/www/htdocs'
+       srcuser: 'root'
+       status: '/usr/bin/tail /var/log/secure'
 
 **Phase 3: Completed filtering (rules).
        Rule id: '5403'