Merge pull request #1787 from Nono-m0le/patch-1

Adding lighttpd decoder/rules

Author: atomicturtle

etc/decoder.xml

@@ -1953,6 +1953,14 @@ Jan  8 19:32:41 tp.lan dropbear[15165]: Pubkey auth succeeded for 'root' with ke
   <order>srcip, action, id</order>
 </decoder>
 
+<!-- lighttpd.
+  - Examples:
+  - 2019-10-29 05:24:27: (mod_fastcgi.c.2543) FastCGI-stderr: PHP Fatal error:  Uncaught ErrorException: Unknown: [CLOSED] IMAP connection broken (server response) (errflg=1) in Unknown:0
+  - 
+  -->
+<decoder name="lighttpd">
+  <prematch_pcre2>^\d\d\d\d-\d\d-\d\d \d\d:\d\d:\d\d: \(</prematch_pcre2>
+</decoder>
 
 
 <!-- Racoon VPN.

etc/rules/lighttpd_rules.xml

@@ -0,0 +1,7 @@
+<group name="local,lighttpd">
+  <rule id="56201" level="10">
+        <decoded_as>lighttpd</decoded_as>
+        <regex>fastcgi</regex>
+        <description>FastCGI error message.</description>
+  </rule>
+</group>