From eed319e896f603471cc4027b353b8535faac4208 Mon Sep 17 00:00:00 2001
From: "Sergey G. Brester" <github@sebres.de>
Date: Wed, 18 Oct 2023 16:06:56 +0200
Subject: [PATCH] gh-3604: filter.d/slapd.conf - switched to single-line
 processing

closes gh-3604
---
 config/filter.d/slapd.conf | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/config/filter.d/slapd.conf b/config/filter.d/slapd.conf
index 22cf4304..791decd2 100644
--- a/config/filter.d/slapd.conf
+++ b/config/filter.d/slapd.conf
@@ -13,13 +13,11 @@ before = common.conf
 
 _daemon = slapd
 
-failregex = ^(?P<__prefix>%(__prefix_line)s)conn=(?P<_conn_>\d+) fd=\d+ ACCEPT from IP=<HOST>:\d{1,5} \(IP=\S+\)\s*<SKIPLINES>(?P=__prefix)conn=(?P=_conn_) op=\d+ RESULT(?:\s(?!err)\S+=\S*)* err=49 text=[\w\s]*$
+prefregex = ^%(__prefix_line)sconn=<F-MLFID>\d+</F-MLFID>(?: (?:fd|op)=\d+){0,2} (?=ACCEPT|RESULT)<F-CONTENT>.+</F-CONTENT>$
+
+failregex = ^<F-NOFAIL>ACCEPT</F-NOFAIL> from IP=<ADDR>:\d{1,5}\s+
+            ^RESULT(?:\s(?!err)\S+=\S*)* err=49\b
 
 ignoreregex =
 
-[Init]
-
-# "maxlines" is number of log lines to buffer for multi-line regex searches
-maxlines = 20
-
-# Author: Andrii Melnyk
+# Author: Andrii Melnyk, Sergey G. Brester