From c33f2ae4ad261a6c0f671bca4d6f24b968f48890 Mon Sep 17 00:00:00 2001
From: "Scott R. Shinn" <scott@atomicorp.com>
Date: Wed, 7 Oct 2020 14:57:01 -0400
Subject: [PATCH] Adding lighttpd rules/decoders

Signed-off-by: Scott R. Shinn <scott@atomicorp.com>
---
 decoders.d/50-crs-lighttpd_decoder.xml | 10 ++++++++++
 rules.d/50-crs-lighttpd_rules.xml      |  8 ++++++++
 2 files changed, 18 insertions(+)
 create mode 100644 decoders.d/50-crs-lighttpd_decoder.xml
 create mode 100644 rules.d/50-crs-lighttpd_rules.xml

diff --git a/decoders.d/50-crs-lighttpd_decoder.xml b/decoders.d/50-crs-lighttpd_decoder.xml
new file mode 100644
index 0000000..37637b0
--- /dev/null
+++ b/decoders.d/50-crs-lighttpd_decoder.xml
@@ -0,0 +1,10 @@
+ 
+<!-- lighttpd.
+  - Examples:
+  - 2019-10-28 01:39:17: (connections-glue.c.200) SSL: 1 error:1417D18C:SSL routines:tls_process_client_hello:version too low
+  - 2019-10-29 05:24:27: (mod_fastcgi.c.2543) FastCGI-stderr: PHP Fatal error:  Uncaught ErrorException: Unknown: [CLOSED] IMAP connection broken (server response) (errflg=1) in Unknown:0
+
+  -->
+<decoder name="lighttpd">
+  <prematch_pcre2>^\d\d\d\d-\d\d-\d\d \d\d:\d\d:\d\d: \(</prematch_pcre2>
+</decoder>
diff --git a/rules.d/50-crs-lighttpd_rules.xml b/rules.d/50-crs-lighttpd_rules.xml
new file mode 100644
index 0000000..5bbddb9
--- /dev/null
+++ b/rules.d/50-crs-lighttpd_rules.xml
@@ -0,0 +1,8 @@
+<group name="local,lighttpd">
+  <rule id="56201" level="10">
+        <decoded_as>lighttpd</decoded_as>
+        <regex>fastcgi</regex>
+        <description>FastCGI error message.</description>
+  </rule>
+</group>
+