The /opt/lce/tools/validate-PRM-regex utility uses the same pattern matching library and parameters as the Log Correlation Engine engine. Tenable recommends using this tool to test your plugins.
validate-PRM-regex takes two arguments:
Note: As the regex argument, validate-PRM-regex accepts either an entire directive line (i.e. regex=regexExpression or regexi=regexExpression) exactly as it would appear in a .prm file; or just the regexExpression. In the latter case, it behaves as if regexExpression were prefixed by regex=.
Note: While you can and should feed validate-PRM-regex complete sample logs for final testing, log fragments are fine when developing.
Note: Enclose each argument in single quotes to protect from shell interpretation.
Log Matched, Extracted 1 or More Substrings
Log Matched, No Substrings Extracted
Tip: Enclose the subpattern you want to extract in parentheses to make it a capturing subpattern.
Log Not Matched
Tip: The error message printed above may help to figure out what is wrong with the regex. In this example, exactly as the error message says, the closing delimiter ) was missing.