From 7dd0ff2282aea31b4273129942239b1d7fdf312c Mon Sep 17 00:00:00 2001 From: "Scott R. Shinn" Date: Wed, 5 Aug 2026 15:35:17 -0400 Subject: [PATCH] Document ### trailing comments for CDB list files. Describe the compile-time comment syntax for ossec-makelists (#1527). --- docs/manual/rules-decoders/rule-lists.rst | 23 ++++++++++++++++++++++- docs/programs/ossec-makelists.rst | 3 ++- 2 files changed, 24 insertions(+), 2 deletions(-) diff --git a/docs/manual/rules-decoders/rule-lists.rst b/docs/manual/rules-decoders/rule-lists.rst index 94a2aa64..703e310d 100644 --- a/docs/manual/rules-decoders/rule-lists.rst +++ b/docs/manual/rules-decoders/rule-lists.rst @@ -129,10 +129,31 @@ Creating cdb lists the following file format is specified: :: key1:value key2:value - key3:diff value + key3:diff value Each key must be unique and is terminated with a colon ``:``. +Comments +^^^^^^^^ + +Trailing comments are supported with the multi-character delimiter ``###``. +Everything from ``###`` to the end of the line is discarded at compile time. +Spaces and tabs immediately before ``###`` are also removed so the stored +value does not retain trailing whitespace. + +A single ``#`` is **not** treated as a comment marker, so keys and values may +still contain ``#`` (for example URL fragments). + +Example: :: + + ### Approved internal networks + 192.168.:RFC 1918 Address space ### private LAN + 10.:RFC 1918 Address space + url:https://example.com/page#anchor ### keep the # in the value + +Blank lines and lines that are only a ``###`` comment are ignored. +Lines without a ``:`` are also ignored. + For IP addresses the dot notation is used for subnet matches :: key CIDR Possible matches diff --git a/docs/programs/ossec-makelists.rst b/docs/programs/ossec-makelists.rst index bc0bda08..7769104a 100644 --- a/docs/programs/ossec-makelists.rst +++ b/docs/programs/ossec-makelists.rst @@ -7,7 +7,8 @@ ossec-makelists The ``ossec-makelists`` utility to compile cdb databases. ``ossec-makelists`` will scan ossec.conf for database files, check the mtime, and recompile all out of date databases. -See :ref:`manual-rule-lists` for more information. +See :ref:`manual-rule-lists` for the list file format (including ``###`` trailing comments) +and for more information. ossec-makelists argument options ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~