Merge pull request #1443 from ddpbsd/1433_dpkg

Fix dpkg grouping rule.

contrib/ossec-testing/tests/dpkg.ini

@@ -0,0 +1,8 @@
+[dpkg log]
+log 1 pass = 2018-05-31 12:09:56 upgrade vlc-plugin-visualization:amd64 3.0.2-1+b1 3.0.3-1
+log 2 pass = 2018-05-11 09:41:49 conffile /etc/redis/redis.conf keep
+
+rule = 2900
+alert = 0
+decoder = windows-date-format
+

etc/rules/syslog_rules.xml

@@ -585,7 +585,15 @@
 <group name="syslog,dpkg,">
   <rule id="2900" level="0">
     <decoded_as>windows-date-format</decoded_as>
-    <regex offset="after_parent">^startup |^status |^remove |^configure |^install |^purge |^trigproc </regex>
+    <regex>^\d\d\d\d-\d\d-\d\d \d\d:\d\d:\d\d startup |</regex>
+    <regex>^\d\d\d\d-\d\d-\d\d \d\d:\d\d:\d\d status |</regex>
+    <regex>^\d\d\d\d-\d\d-\d\d \d\d:\d\d:\d\d remove |</regex>
+    <regex>^\d\d\d\d-\d\d-\d\d \d\d:\d\d:\d\d configure |</regex>
+    <regex>^\d\d\d\d-\d\d-\d\d \d\d:\d\d:\d\d install |</regex>
+    <regex>^\d\d\d\d-\d\d-\d\d \d\d:\d\d:\d\d purge |</regex>
+    <regex>^\d\d\d\d-\d\d-\d\d \d\d:\d\d:\d\d trigproc |</regex>
+    <regex>^\d\d\d\d-\d\d-\d\d \d\d:\d\d:\d\d conffile |</regex>
+    <regex>^\d\d\d\d-\d\d-\d\d \d\d:\d\d:\d\d upgrade </regex>
     <description>Dpkg (Debian Package) log.</description>
   </rule>