help with SEDCMD

[jambajuice]

I'm trying to clean up events from a Nessus 4 NBE file. Sample results look like the following:

results|192.168.2|192.168.2.183|compaq-https (2381/tcp)|40406|Security Note|Synopsis :\n\nNessus encountered errors while running its generic CGI attacks.\n\nDescription :\n\nNessus ran into trouble while running its generic CGI tests against\nthe remote web server (for example, connection refused, timeout, etc). \nWhen this happens, Nessus aborts the current test and switches to the\nnext CGI script on the same port or to another web server.  Thus, test\nresults may be incomplete.\n\nSolution :\n\nRescan with a longer network timeout or less parallelism for example,\nby changing the following options in the scan policy :\n\n  - Network -> Network Receive Timeout (check_read_timeout)\n\n  - Options -> Number of hosts in parallel (max_hosts)\n\n  - Options -> Number of checks in parallel (max_checks)\n\nRisk factor :\n\nNone\n\nPlugin output :\n\nNessus encountered :\n\n  - 1 error involving SQL injection (on HTTP headers) checks.\n\n

I would like to replace every instance of \n with a space. My props.conf looks like this:

[nessus]
BREAK_ONLY_BEFORE = results|
SEDCMD-newline = s/\\n//

What am I doing wrong here?

Thx.

Craig

[araitz]

Maybe:

[nessus]
BREAK_ONLY_BEFORE = results|
SEDCMD-newline = s/\\n/\ /

Or:

[nessus]
BREAK_ONLY_BEFORE = results|
SEDCMD-newline = s/\\n/ /

[ftk]

your second config is correct.