forked from simple-evcorr/rulesets
-
Notifications
You must be signed in to change notification settings - Fork 0
/
vtund.sec
67 lines (53 loc) · 1.82 KB
/
vtund.sec
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
#############################################################################
# VTUN events
#
# Copyright (C) 2003-2009 Matt Jonkman
# This is free software. You may redistribute copies of it under the terms of
# the GNU General Public License version 2.
# There is NO WARRANTY, to the extent permitted by law.
#############################################################################
type=Single
ptype=RegExp
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Session (\S+)\[\S\] opened
desc=$0
action=add GENERAL_REPORT %t: %s;
type=Single
ptype=RegExp
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: BlowFish encryption initialized
desc=$0
action=add GENERAL_REPORT %t: VTUN Tunnel Opened on $1
type=Single
ptype=RegExp
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: VTun client ver\s+(.*)
desc=$0
action=add GENERAL_REPORT %t: VTUN Server Started on $1 version $2
type=Single
ptype=RegExp
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Connecting to (.*)
desc=$0
action=add GENERAL_REPORT VTUN %s
type=Single
ptype=RegExp
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Denied connection from (\d+\.\d+\.\d+\.\d+):\d+
desc=$0
action=add GENERAL_REPORT %t: VTUN Connection DENIED by $1 from $2
type=Single
ptype=RegExp
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Connection denied by (.*)
desc=$0
action=add GENERAL_REPORT %t: VTUN Connection DENIED by $2 for $1
type=Single
ptype=RegExp
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Exit
desc=$0
action=add GENERAL_REPORT %t: VTUN Exit on $1
type=Single
ptype=RegExp
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Can't resolv server address: (.*)
desc=$0
action=add GENERAL_REPORT %t: VTUN Cannot Resolve Target $2 on $1
type=Single
ptype=RegExp
pattern=\S+\s+\d+\s+\S+\s+(\S+)\s+vtund\[\d+\]: Session (/S+) closed
desc=$0
action=add GENERAL_REPORT %t: VTUN Session $2 Closed on $1