From 4eedf9d4e1259fb3b3850eb9f2efe803995d0b90 Mon Sep 17 00:00:00 2001
From: Daniel Black <grooverdan@users.sourceforge.net>
Date: Sun, 15 Dec 2013 23:49:38 +0000
Subject: [PATCH] ENH: use ipmatches for action xarf-login-attack

---
 config/action.d/xarf-login-attack.conf | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/config/action.d/xarf-login-attack.conf b/config/action.d/xarf-login-attack.conf
index 7ae27a1f..c5ac5110 100644
--- a/config/action.d/xarf-login-attack.conf
+++ b/config/action.d/xarf-login-attack.conf
@@ -43,7 +43,7 @@ actionban = oifs=${IFS}; IFS=.;SEP_IP=( <ip> ); set -- ${SEP_IP} ;ADDRESSES=$(di
             FROM=<sender>
             SERVICE=<service>
             FAILURES=<failures>
-            MATCHES=<matches>
+            MATCHES='<matches>'
             REPORTID=<time>@`uname -n`
             TLP=<tlp>
             PORT=<port>
@@ -51,8 +51,7 @@ actionban = oifs=${IFS}; IFS=.;SEP_IP=( <ip> ); set -- ${SEP_IP} ;ADDRESSES=$(di
             if [ ! -z "$ADDRESSES" ]; then
                 (printf -- %%b "<header>\n<message>\n<report>\n${MATCHES}\n";
                  date '+Note: Local timezone is %%z (%%Z)';
-                 tail -n <loglines> <logpath> | grep '[^0-9]<ip>[^0-9]';
-                 printf -- %%b "<footer>") | <mailcmd> <mailargs> ${ADDRESSES//,/\" \"}
+                 printf -- %%b "<ipmatches>\n\n<footer>") | <mailcmd> <mailargs> ${ADDRESSES//,/\" \"}
             fi
 
 actionunban =