diff -urN ossec-hids-2.6.orig/src/config/localfile-config.c ossec-hids-2.6/src/config/localfile-config.c
--- ossec-hids-2.6.orig/src/config/localfile-config.c	2011-07-11 21:36:58.000000000 +0200
+++ ossec-hids-2.6/src/config/localfile-config.c	2012-08-10 14:41:06.752624100 +0200
@@ -26,7 +26,6 @@
     int glob_offset = 0;
     #endif
 
-
     /* XML Definitions */
     char *xml_localfile_location = "location";
     char *xml_localfile_command = "command";
@@ -317,35 +316,58 @@
             else if(strcmp(logf[pl].logformat, "full_command") == 0)
             {
             }
-            else if(strncmp(logf[pl].logformat, "multi-line", 10) == 0)
+            else if(strncmp(logf[pl].logformat, "multiline", 10) == 0)
             {
-                int x = 0;
-                logf[pl].logformat+=10;
-
-                while(logf[pl].logformat[0] == ' ')
-                    logf[pl].logformat++;
-                
-                if(logf[pl].logformat[0] != ':')
-                {
-                    merror(XML_VALUEERR,ARGV0,node[i]->element,node[i]->content);
+                if (node[i]->attributes == NULL || node[i]->values == NULL) {
+                    merror(XML_ATTRERR,ARGV0,node[i]->element,node[i]->content);
                     return(OS_INVALID);
                 }
-                logf[pl].logformat++;
 
-                while(*logf[pl].logformat == ' ')
-                    logf[pl].logformat++;
-                
-                while(logf[pl].logformat[x] >= '0' && logf[pl].logformat[x] <= '9')    
-                    x++;
+                int a = 0;
 
-                while(logf[pl].logformat[x] == ' ')
-                    x++;
+                while (node[i]->attributes[a] && node[i]->values[a]) {
+                    if (strncmp(node[i]->attributes[a], "lines", 5) == 0)
+                        // ERROR: This is non-portable 32 vs. 64 bit!
+                        logf[pl].data = (void *)atol(node[i]->values[a]);
+                    a++;
+                }
 
-                if(logf[pl].logformat[x] != '\0')
-                {
-                    merror(XML_VALUEERR,ARGV0,node[i]->element,node[i]->content);
+            }
+            else if(strncmp(logf[pl].logformat, "modsec_audit", 10) == 0)
+            {
+            }
+            else if(strncmp(logf[pl].logformat, "regex", 10) == 0)
+            {
+                if (node[i]->attributes == NULL || node[i]->values == NULL) {
+                    merror(XML_ATTRERR,ARGV0,node[i]->element,node[i]->content);
                     return(OS_INVALID);
                 }
+
+                int a = 0;
+                logreader_regex *lr;
+
+                if (logf[pl].data == NULL) {
+                    os_calloc(1, sizeof(logreader_regex), lr);
+                    logf[pl].data = lr;
+                } else
+                    lr = (logreader_regex *)logf[pl].data;
+
+                while (node[i]->attributes[a] && node[i]->values[a]) {
+
+                    if (strncmp(node[i]->attributes[a], "start_regex", 11) == 0) {
+                        if (lr->start_regex != NULL)
+                            os_free(lr->start_regex);
+                        lr->start_regex = strndup(node[i]->values[a], OS_PATTERN_MAXSIZE);
+                    }
+
+                    if (strncmp(node[i]->attributes[a], "end_regex", 11) == 0) {
+                        if (lr->start_regex != NULL)
+                            os_free(lr->start_regex);
+                        lr->start_regex = strndup(node[i]->values[a], OS_PATTERN_MAXSIZE);
+                    }
+
+                    a++;
+                }
             }
             else if(strcmp(logf[pl].logformat, EVENTLOG) == 0)
             {
diff -urN ossec-hids-2.6.orig/src/config/localfile-config.h ossec-hids-2.6/src/config/localfile-config.h
--- ossec-hids-2.6.orig/src/config/localfile-config.h	2011-07-11 21:36:58.000000000 +0200
+++ ossec-hids-2.6/src/config/localfile-config.h	2012-08-10 14:24:45.028210999 +0200
@@ -23,6 +23,12 @@
 /* For ino_t */
 #include <sys/types.h>
 
+/* Logreader config for regex configuration types*/
+typedef struct _logreader_regex
+{
+    char *start_regex;        
+    char *end_regex;
+}logreader_regex;
 
 /* Logreader config */
 typedef struct _logreader
@@ -52,6 +58,9 @@
     void (*read)(int i, int *rc, int drop_it);
 
     FILE *fp;
+
+    /* Private configuration data specific to each log type */
+    void *data;
 }logreader;
 
 typedef struct _logreader_config
diff -urN ossec-hids-2.6.orig/src/error_messages/error_messages.h ossec-hids-2.6/src/error_messages/error_messages.h
--- ossec-hids-2.6.orig/src/error_messages/error_messages.h	2011-07-11 21:36:58.000000000 +0200
+++ ossec-hids-2.6/src/error_messages/error_messages.h	2012-08-10 14:15:57.922452276 +0200
@@ -92,6 +92,7 @@
 #define NO_CONFIG       "%s(1239): ERROR: Configuration file not found: '%s'."
 #define INVALID_TIME    "%s(1240): ERROR: Invalid time format: '%s'."
 #define INVALID_DAY     "%s(1241): ERROR: Invalid day format: '%s'."
+#define XML_ATTRERR     "%s(1242): ERROR: Attribute(s) error for element '%s': %s."
 
 #define MAILQ_ERROR	    "%s(1221): ERROR: No Mail queue at %s"
 #define IMSG_ERROR	    "%s(1222): ERROR: Invalid msg: %s"
Binary files ossec-hids-2.6.orig/src/isbigendian and ossec-hids-2.6/src/isbigendian differ
diff -urN ossec-hids-2.6.orig/src/logcollector/logcollector.c ossec-hids-2.6/src/logcollector/logcollector.c
--- ossec-hids-2.6.orig/src/logcollector/logcollector.c	2011-07-11 21:36:58.000000000 +0200
+++ ossec-hids-2.6/src/logcollector/logcollector.c	2012-08-10 15:57:02.644181894 +0200
@@ -221,10 +221,18 @@
                 }
                 logff[i].read = (void *)read_djbmultilog;
             }
-            else if(logff[i].logformat[0] >= '0' && logff[i].logformat[0] <= '9')
+            else if(strcmp("multitline", logff[i].logformat) == 0)
             {
                 logff[i].read = (void *)read_multiline;
             }
+            else if(strcmp("modsec_audit", logff[i].logformat) == 0)
+            {
+                logff[i].read = (void *)read_modsec_audit;
+            }
+            else if(strcmp("regex", logff[i].logformat) == 0)
+            {
+                logff[i].read = (void *)read_regex;
+            }
             else
             {
                 logff[i].read = (void *)read_syslog;
diff -urN ossec-hids-2.6.orig/src/logcollector/logcollector.h ossec-hids-2.6/src/logcollector/logcollector.h
--- ossec-hids-2.6.orig/src/logcollector/logcollector.h	2011-07-11 21:36:58.000000000 +0200
+++ ossec-hids-2.6/src/logcollector/logcollector.h	2012-08-10 15:59:10.458365870 +0200
@@ -60,6 +60,12 @@
 /* read multi line logs. */
 void *read_multiline(int pos, int *rc, int drop_it);
 
+/* read mod_security audit logs. */
+void *read_modsec_audit(int pos, int *rc, int drop_it);
+
+/* read regex delimited logs. */
+void *read_regex(int pos, int *rc, int drop_it);
+
 /* Read DJB multilog format */
 /* Initializes multilog. */
 int init_djbmultilog(int pos);
diff -urN ossec-hids-2.6.orig/src/logcollector/read_modsec_audit.c ossec-hids-2.6/src/logcollector/read_modsec_audit.c
--- ossec-hids-2.6.orig/src/logcollector/read_modsec_audit.c	1970-01-01 01:00:00.000000000 +0100
+++ ossec-hids-2.6/src/logcollector/read_modsec_audit.c	2012-08-10 15:34:08.001203221 +0200
@@ -0,0 +1,158 @@
+/* @(#) $Id$ */
+
+/* Copyright (C) 2010 Trend Micro Inc.
+ * All right reserved.
+ *
+ * This program is a free software; you can redistribute it
+ * and/or modify it under the terms of the GNU General Public
+ * License (version 2) as published by the FSF - Free Software
+ * Foundation
+ */
+
+/* Read the syslog */
+
+
+#include "shared.h"
+#include "logcollector.h"
+
+
+
+/* Read multiline logs. */
+void *read_modsec_audit(int pos, int *rc, int drop_it)
+{
+    int __ms = 0, __bs = 0;
+    int buffer_size = 0;
+    char *p;
+    char str[OS_MAXSTR + 1];
+    char buffer[OS_MAXSTR +1];
+
+    fpos_t fp_pos;
+
+    buffer[0] = '\0';
+    buffer[OS_MAXSTR] = '\0';
+    str[OS_MAXSTR]= '\0';
+    *rc = 0;
+
+    int in_block = 0;
+
+    /* Getting initial file location */
+    fgetpos(logff[pos].fp, &fp_pos);
+
+    while(fgets(str, OS_MAXSTR - OS_LOG_HEADER, logff[pos].fp) != NULL)
+    {
+
+        /* Getting the last occurence of \n */
+        if ((p = strrchr(str, '\n')) != NULL) 
+        {
+            *p = '\0';
+        }
+ 
+        /* If we didn't get the new line, because the
+         * size is large, send what we got so far.
+         */
+        else if(strlen(str) >= (OS_MAXSTR - OS_LOG_HEADER - 2))
+        {
+            /* Message size > maximum allowed */
+            __ms = 1;
+        }
+        else
+        {
+            /* Message not complete. Return. */
+            debug1("%s: Message not complete. Trying again: '%s'", ARGV0,str);
+            fsetpos(logff[pos].fp, &fp_pos);
+            break;
+        }    
+        
+        #ifdef WIN32
+        if ((p = strrchr(str, '\r')) != NULL)
+        {
+            *p = '\0';
+        }
+        #endif
+                      
+        debug2("%s: DEBUG: Reading message: '%s'", ARGV0, str);
+
+        // See if the line has the following form: --62a78a12-A--
+        // If so, than it is a start marker.
+        if (in_block == 0) {
+
+            if (str[0] == '-' && str[1] == '-' && isxdigit(str[2])
+                    && isxdigit(str[3]) && isxdigit(str[4])
+                    && isxdigit(str[5]) && isxdigit(str[6])
+                    && isxdigit(str[7]) && isxdigit(str[8])
+                    && isxdigit(str[9]) && str[10] == '-'
+                    && str[11] == 'A' && str[12] == '-'
+                    && str[13] == '-' && str[14] == '\n')
+                in_block = 1;
+            continue;
+        }
+
+        /* Adding to buffer. */
+        buffer_size = strlen(buffer);
+        if(buffer[0] != '\0')
+        {
+            buffer[buffer_size] = ' ';
+            buffer_size++;
+        }
+
+        if (buffer_size + strlen(str) > OS_MAXSTR - OS_LOG_HEADER - 2)
+            __bs = 1;
+        else
+            strncpy(buffer + buffer_size, str, OS_MAXSTR - buffer_size -2);
+
+        // If we don't have yet an end of the message and maximum size wasn't
+        // exceeded then go to the next line.
+        if (!__ms && !__bs &&
+            (str[0] != '-' || str[1] != '-' || !isxdigit(str[2])
+                    || !isxdigit(str[3]) || !isxdigit(str[4])
+                    || !isxdigit(str[5]) || !isxdigit(str[6])
+                    || !isxdigit(str[7]) || !isxdigit(str[8])
+                    || !isxdigit(str[9]) || str[10] != '-'
+                    || str[11] != 'Z' || str[12] != '-'
+                    || str[13] != '-' || str[14] != '\n'))
+            continue;
+
+        in_block = 0;
+
+        /* Sending message to queue */
+        if(drop_it == 0)
+        {
+            if(SendMSG(logr_queue, buffer, logff[pos].file,
+                        LOCALFILE_MQ) < 0)
+            {
+                merror(QUEUE_SEND, ARGV0);
+                if((logr_queue = StartMQ(DEFAULTQPATH,WRITE)) < 0)
+                {
+                    ErrorExit(QUEUE_FATAL, ARGV0, DEFAULTQPATH);
+                }
+            }
+        }
+
+        buffer[0] = '\0';
+
+        /* Incorrectly message size */
+        if(__ms || __bs)
+        {
+            merror("%s: Large message size: '%s'", ARGV0, str);
+
+            // The following isn't used if buffer size was exceeded. Upon return
+            // to this function we'll anyway discard anything that isn't a start
+            // marker.
+            while(__ms && fgets(str, OS_MAXSTR - 2, logff[pos].fp) != NULL)
+            {
+                /* Getting the last occurence of \n */
+                if ((p = strrchr(str, '\n')) != NULL)
+                {
+                    break;
+                }
+            }
+        }
+        
+        fgetpos(logff[pos].fp, &fp_pos);
+        continue;
+    }
+
+    return(NULL); 
+}
+
+/* EOF */
diff -urN ossec-hids-2.6.orig/src/logcollector/read_multiline.c ossec-hids-2.6/src/logcollector/read_multiline.c
--- ossec-hids-2.6.orig/src/logcollector/read_multiline.c	2011-07-11 21:36:58.000000000 +0200
+++ ossec-hids-2.6/src/logcollector/read_multiline.c	2012-08-10 15:19:57.887979558 +0200
@@ -35,7 +35,8 @@
     str[OS_MAXSTR]= '\0';
     *rc = 0;
 
-    linecount = atoi(logff[pos].logformat);
+    // ERROR: This is non-portable 32 vs. 64 bit!
+    linecount = (int)(logff[pos].data);
 
     /* Getting initial file location */
     fgetpos(logff[pos].fp, &fp_pos);
@@ -86,7 +87,6 @@
 
         strncpy(buffer + buffer_size, str, OS_MAXSTR - buffer_size -2);
 
-        
         if(linesgot < linecount)
         {
             continue;
diff -urN ossec-hids-2.6.orig/src/logcollector/read_regex.c ossec-hids-2.6/src/logcollector/read_regex.c
--- ossec-hids-2.6.orig/src/logcollector/read_regex.c	1970-01-01 01:00:00.000000000 +0100
+++ ossec-hids-2.6/src/logcollector/read_regex.c	2012-08-10 15:50:01.773576087 +0200
@@ -0,0 +1,149 @@
+/* @(#) $Id$ */
+
+/* Copyright (C) 2010 Trend Micro Inc.
+ * All right reserved.
+ *
+ * This program is a free software; you can redistribute it
+ * and/or modify it under the terms of the GNU General Public
+ * License (version 2) as published by the FSF - Free Software
+ * Foundation
+ */
+
+/* Read the syslog */
+
+
+#include "shared.h"
+#include "logcollector.h"
+
+
+
+/* Read multiline logs. */
+void *read_regex(int pos, int *rc, int drop_it)
+{
+    int __ms = 0, __bs = 0;
+    int buffer_size = 0;
+    char *p;
+    char str[OS_MAXSTR + 1];
+    char buffer[OS_MAXSTR +1];
+
+    fpos_t fp_pos;
+
+    buffer[0] = '\0';
+    buffer[OS_MAXSTR] = '\0';
+    str[OS_MAXSTR]= '\0';
+    *rc = 0;
+
+    int in_block = 0;
+
+    logreader_regex *lr = (logreader_regex *)logff[pos].data;
+
+    /* Getting initial file location */
+    fgetpos(logff[pos].fp, &fp_pos);
+
+    while(fgets(str, OS_MAXSTR - OS_LOG_HEADER, logff[pos].fp) != NULL)
+    {
+
+        /* Getting the last occurence of \n */
+        if ((p = strrchr(str, '\n')) != NULL) 
+        {
+            *p = '\0';
+        }
+ 
+        /* If we didn't get the new line, because the
+         * size is large, send what we got so far.
+         */
+        else if(strlen(str) >= (OS_MAXSTR - OS_LOG_HEADER - 2))
+        {
+            /* Message size > maximum allowed */
+            __ms = 1;
+        }
+        else
+        {
+            /* Message not complete. Return. */
+            debug1("%s: Message not complete. Trying again: '%s'", ARGV0,str);
+            fsetpos(logff[pos].fp, &fp_pos);
+            break;
+        }    
+        
+        #ifdef WIN32
+        if ((p = strrchr(str, '\r')) != NULL)
+        {
+            *p = '\0';
+        }
+        #endif
+                      
+        debug2("%s: DEBUG: Reading message: '%s'", ARGV0, str);
+
+        // Check if starting regex matches...
+        if (in_block == 0) {
+
+            if (OS_Regex(lr->start_regex, str))
+                in_block = 1;
+
+            continue;
+        }
+
+        /* Adding to buffer. */
+        buffer_size = strlen(buffer);
+        if(buffer[0] != '\0')
+        {
+            buffer[buffer_size] = ' ';
+            buffer_size++;
+        }
+
+        if (buffer_size + strlen(str) > OS_MAXSTR - OS_LOG_HEADER - 2)
+            __bs = 1;
+        else
+            strncpy(buffer + buffer_size, str, OS_MAXSTR - buffer_size -2);
+
+        // If we don't have yet an end of the message and maximum size wasn't
+        // exceeded then go to the next line.
+        if (!__ms && !__bs &&
+            (!(lr->end_regex != NULL && OS_Regex(lr->end_regex, str)) ||
+             !(lr->end_regex == NULL && OS_Regex(lr->start_regex, str))))
+            continue;
+
+        in_block = 0;
+
+        /* Sending message to queue */
+        if(drop_it == 0)
+        {
+            if(SendMSG(logr_queue, buffer, logff[pos].file,
+                        LOCALFILE_MQ) < 0)
+            {
+                merror(QUEUE_SEND, ARGV0);
+                if((logr_queue = StartMQ(DEFAULTQPATH,WRITE)) < 0)
+                {
+                    ErrorExit(QUEUE_FATAL, ARGV0, DEFAULTQPATH);
+                }
+            }
+        }
+
+        buffer[0] = '\0';
+
+        /* Incorrectly message size */
+        if(__ms || __bs)
+        {
+            merror("%s: Large message size: '%s'", ARGV0, str);
+
+            // The following isn't used if buffer size was exceeded. Upon return
+            // to this function we'll anyway discard anything that isn't a start
+            // marker.
+            while(__ms && fgets(str, OS_MAXSTR - 2, logff[pos].fp) != NULL)
+            {
+                /* Getting the last occurence of \n */
+                if ((p = strrchr(str, '\n')) != NULL)
+                {
+                    break;
+                }
+            }
+        }
+        
+        fgetpos(logff[pos].fp, &fp_pos);
+        continue;
+    }
+
+    return(NULL); 
+}
+
+/* EOF */
