diff --git a/server/datetemplate.py b/server/datetemplate.py index 0754391b..decaee1c 100644 --- a/server/datetemplate.py +++ b/server/datetemplate.py @@ -78,8 +78,7 @@ class DateEpoch(DateTemplate): def __init__(self): DateTemplate.__init__(self) - # We already know the format for TAI64N - self.setRegex("^\d{10}(\.\d{6})?") + self.setRegex("(?:^|(?P(?<=audit\()))\d{10}(?:\.\d{3,6})?(?(selinux)(?=:\d+\)))") def getDate(self, line): date = None diff --git a/testcases/datedetectortestcase.py b/testcases/datedetectortestcase.py index 8971ecfd..508156ff 100644 --- a/testcases/datedetectortestcase.py +++ b/testcases/datedetectortestcase.py @@ -83,6 +83,7 @@ class DateDetectorTest(unittest.TestCase): "<01/23/05@21:59:59>", "050123 21:59:59", # MySQL "Jan-23-05 21:59:59", # ASSP like + "audit(1106513999.123:987)", # SELinux ): log = sdate + "[sshd] error: PAM: Authentication failure" # exclude