OSSEC的正则表达式语法

正则表达式语法 Regular Expression Syntax

http://www.ossec.net/doc/syntax/regex.html

目前OSSEC支持两种：

• OR_Regex or regex
• OS_Match or sregex

1) OR_Regex or regex：C中简单快速的正则表达式库。

表达式 Supported expressions:

\w  ->  A-Z, a-z, 0-9 characters
\d  ->  0-9 characters
\s  ->  For spaces " "
\t  ->  For tabs.
\p  ->  ()*+,-.:;<=>?[] (punctuation characters)
\W  ->  For anything not \w
\D  ->  For anything not \d
\S  ->  For anything not \s
\.  ->  For anything

修饰符 Modifiers:
+  ->  To match one or more times (eg \w+ or \d+)
* -> To match zero or more times (eg \w* or \p*)

特殊字符 Special Characters:

^ -> To specify the beginning of the text.
$ -> To specify the end of the text.
| -> To create an "OR" between multiple patterns.

Characters Escaping

To utilize the following characters they must be escaped:

$ -> \$
( -> \(
) -> \)
\ -> \\
| -> \|

2) OS_Match or sregex：比上一种更快，但只支持简单的字符串匹配和一些特殊字符。

特殊字符 Special Characters:

^ -> To specify the beginning of the text.
$ -> To specify the end of the text.
| -> To create an "OR" between multiple patterns.