[Lognorm] type:char-to: issues (?)

[Champ Clark III [Softwink]]

On Tue, Jan 18, 2011 at 06:59:28PM +0100, Rainer Gerhards wrote:
> Mhhhh... on the other hand it is "unparsed" -- that can not be interference.
> I Think I'll run it through the normalizer myself tomorrow morning...

	Yep.... 

rule=: rule=: unexpected RCODE %failcode:word% resolving '%type:char-to:\x27%': %src-ip%ipv4#%src-port:number%

Normalize output: [cee at 115 originalmsg=" unexpected RCODE (SERVFAIL) resolving 'rbldns2.sorbs.net/A/IN': 174.36.235.174#53" unparsed-data=".36.235.174#53"]

-- 
        Champ Clark III | Softwink, Inc | 800-538-9357 x 101
                     http://www.softwink.com

GPG Key ID: 58A2A58F
Key fingerprint = 7734 2A1C 007D 581E BDF7  6AD5 0F1F 655F 58A2 A58F
If it wasn't for C, we'd be using BASI, PASAL and OBOL.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 197 bytes
Desc: not available
URL: <http://lists.adiscon.net/pipermail/lognorm/attachments/20110118/6f33ac0b/attachment-0001.pgp>